Is it risky to post your apache site.conf files

October 21, 2014 2.4k views
5d0b8e2ee83fb30cf09b17a854c6d969cf5624f2
By:
sierracircle

Occasionally on the forums people post their site.conf files. or I have asked people to post it to troubleshoot problems

I am wondering if there is security risks doing that. I cannot think of anything someone could take advantage of with that info.

Does anyone know if there is information in a typical site.conf file that could be exploited?

Log In to Comment
2 Answers
JonsJava October 21, 2014

Not that I can think of. I even have a tool to automate the creation of those files for anybody.

http://YOUR_DOMAIN_OR_SUBDOMAIN.c.jonsjava.com (centos/rhel/fedora)
http://YOUR_DOMAIN_OR_SUBDOMAIN.u.jonsjava.com (ubuntu/debian)

unless yours is highly configured (and thereby falling outside the "typical" part you spoke of), there's nothing damaging in those.

One caveat: if you have a poorly performing or badly-coded server-side script, they can use it to simplify directory traversal after finding an XSS entrypoint, but that's after it's been hacked, so it's still trivial.

Reply
asb MOD October 21, 2014

There's very little sensitive information that could be exposed in an Apache site.conf. Some things like knowing that AllowOverride All is set on a directory could in theory provide an attacker something to probe, though following other best practices would thwart that. The attacker would already need write access to that directory to create an .htaccess file. Another theoretical piece of information that could be gleaned is whether SSL3 is enabled or not to take advantage of the "POODLE" vulnerability, though that is usally configured in /etc/apache2/mods-available/ssl.conf

If you follow general security best practices and apply security updates in a timely manner, sharing your Apache configuration won't be a problem at all.

How To Protect your Server Against the POODLE SSLv3 Vulnerability
by Justin Ellingwood
The POODLE SSLv3 vulnerability is a security issue that affects all implementations of SSLv3. This vulnerability allows an attacker to decrypt messages sent using this protocol version by exploiting a weakness the way the padding of a message are checked. In this guide, we'll explain how the vulnerability work, and tell you how to disable SSLv3 on some common services.
Reply
  • sierracircle October 21, 2014

    Thanks for the feedback @asb and @jon231325

    this jibes with what I was thinking, but I thought I had better check. It seems to come up a lot in the forums...people posting site.conf, and it suddenly occurred to me that I was not entirely sure of the safety implications.

    I once (many years ago) posted my entire wp-config.php file on a forum, passwords and all!

Have another answer? Share your knowledge.