Occasionally on the forums people post their site.conf files. or I have asked people to post it to troubleshoot problems
I am wondering if there is security risks doing that. I cannot think of anything someone could take advantage of with that info.
Does anyone know if there is information in a typical site.conf file that could be exploited?
Not that I can think of. I even have a tool to automate the creation of those files for anybody.
http://YOUR_DOMAIN_OR_SUBDOMAIN.c.jonsjava.com (centos/rhel/fedora)
http://YOUR_DOMAIN_OR_SUBDOMAIN.u.jonsjava.com (ubuntu/debian)
unless yours is highly configured (and thereby falling outside the "typical" part you spoke of), there's nothing damaging in those.
One caveat: if you have a poorly performing or badly-coded server-side script, they can use it to simplify directory traversal after finding an XSS entrypoint, but that's after it's been hacked, so it's still trivial.
There's very little sensitive information that could be exposed in an Apache site.conf. Some things like knowing that AllowOverride All is set on a directory could in theory provide an attacker something to probe, though following other best practices would thwart that. The attacker would already need write access to that directory to create an .htaccess file. Another theoretical piece of information that could be gleaned is whether SSL3 is enabled or not to take advantage of the "POODLE" vulnerability, though that is usally configured in /etc/apache2/mods-available/ssl.conf
If you follow general security best practices and apply security updates in a timely manner, sharing your Apache configuration won't be a problem at all.
Thanks for the feedback @asb and @jon231325
this jibes with what I was thinking, but I thought I had better check. It seems to come up a lot in the forums...people posting site.conf, and it suddenly occurred to me that I was not entirely sure of the safety implications.
I once (many years ago) posted my entire wp-config.php file on a forum, passwords and all!
