Security – Can’t get rid of Apache server-status

apache-2.2fedoraSecurity

I am trying to deactivate the /server-status from an Apache2 running on a Fedora server.

I tried to comment the lines in /etc/httpd/conf/httpd.conf and I also tried to make it work only for my IP address, like that:

<Location /server-status>
   SetHandler server-status
   Order deny,allow
   Deny from all
   Allow from 192.168.100.138
   #Allow from 194.106.52.52
   #Allow from localhost
</Location>

There is also a Tomcat behind the Apache, and I found that configuration on it, played with that also but got no luck…

/etc/httpd/vhosts.d/enabled/mysite.conf

#JkUnMount /server-status tomcat6

<Location /server-status>
    SetHandler server-status
    Order deny,allow
    Deny from all
    #Allow from localhost
</Location>

I tried to comment and uncomment the JkUnMount line and also the whole location block code.

What am I doing wrong?
Is there any other configuration file that I didn't notice?

Best Answer

1. Find all matches of /server-status in web server Apache log files using command:

% find /etc/httpd -type f -iname '*.conf' |xargs grep -n "/server-status"

2. Comment all matched blocks using # 3. Check web server Apache config:

% /sbin/service httpd configtest

3. Restart web server Apache using command:

% /sbin/service httpd graceful
Related Topic