Ego vs Ergo

Just turned on server-status or server-info?

I have previously not made much use of Apache’s server-status and server-info functions, but recently I’ve found a use for them as traffic and development increases on my new server.

After a bit of reading online, I noticed that The Apache Software Foundation doesn’t even protect their own server-status page. I asked for peoples’ opinions of this practise, since, at first glance, there is very little to be concerned about serving server-status information to the general public.

Thankfully, I took a second glance.

As my friend and highly skilled programmer Nebu Pookins soon pointed out:

What can you do with server-status besides regexp for “GET .*\?.*pass(word)?\=.*” (in which case you got bigger problems)?

I glibly replied that no programmer worth his salt would implement a password mechanism using an exposed method like a GET variable. However, there are many other parts of your site that server-status can expose which should probably remain private. For instance, if you have taken pains to hide your web-based administrative tools, you will expose them to the world.

How can you go about protecting server-status and, equally importantly, server-info?

The first thing to realize about these two “pages” is that they are internal functions to httpd, and can not be protected by any mechanism above the server layer (like a PHP script or a /server-status/.htaccess file).

The answer is extremely simple: embed the directives you would otherwise put inside an .htaccess file directly into the <Location /server-status> directive, like so:

<IfModule mod_status.c>
#
# Allow server status reports generated by mod_status,
# with the URL of http://servername/server-status
# Uncomment and change the ".example.com" to allow
# access from other hosts.
#
<Location /server-status>
    SetHandler server-status
    Order deny,allow

    AuthType Basic
    AuthName "Developer Zone
    AuthUserFile /etc/apache2/extra/mod_status.htpasswd
    Require user developer_joe
</Location>
</IfModule>

Exactly the same can be done for server-info.

I should point out that this method has all of the pitfalls of httpd’s Basic htaccess method and is not foolproof. This will, however, allow you at least to password protect some sensitive information, while still allowing you access to it from outside your LAN.

If your development machine always has a FQDN, you can also add that above in an “Allow from name.com” drective.

For additional security, you can change the name of the path to the server-status to some random string, which will make it difficult to find in the first place. Security through obscurity is among the weakest methods, but another layer never hurts.

I welcome your commetns and experience(s).