2

Is it a good idea to preventively disable (public) access to certain filetypes (by extension) and/or by filenames:

  1. in the server configuration (in case of a shared hosting server) or,
  2. as a rewrite rule for a website or web application?

For example filenames like:

  1. readme
  2. changelog
  3. debug
  4. errors
  5. phpinfo

Or the following file extensions in combination with above filenames: php, log, html, htm, txt, doc, docx, rtf and possibly more and without any file extension.

And denying access to specific file extensions completely like: svn, git, sh, bat, cmd, sql, ini, config, conf, bak, backup and old.

Is it a good idea to do so? In order to prevent information leakage when those file are (accidentally) moved into a public folder.

  • i could see this causing a dev to go bonkers one day when a file unexpectedly 404s even though it's right there, so at least give it a meaningful error message if it's blocked. remember that those rules need cpu to validate as well, so more is not always better... – dandavis Jun 21 '16 at 9:45
  • Very interesting question! But I think you are right that the second part is off topic here. I would remove it from this question and just ask at Server Fault instead, possibly linking to this question. But I might be wrong here. – Anders Jun 21 '16 at 10:44
  • Ultimately it depends on the web application in question, if it's a PHP index for a document download server... well you'll need to accept PHP and document file types in that case. – ewanm89 Jun 23 '16 at 10:28
  • @ewanm89 I didn't mean to block the php extension entirely for public access. But to block readme.php, changelog.php, debug.php, errors.php and phpinfo.php from public access (and potentially more). As well as those filenames with the other suggested file extensions. – Bob Ortiz Jun 23 '16 at 10:35
  • 5
    I always prefer a whitelist instead of a blacklist. I think "What does the browser need to use my website?" Most of the time it is just something like index.php, *.css, *.js and *.png/gif/jpeg. The rest gets a 403. Furthermore I prefer to keep all my stuff out of the webroot and have just index.php and static files in there. – AmazingDreams Jun 23 '16 at 10:35
1
+50

Is it a good idea to preventively disable (public) access to certain filetypes (by extension) and/or by filenames?

Absolutely! In fact all access should be denied and only allow known good requests. This is otherwise known as "Default Deny" or "Whitelisting".

Marcus Ranum has some great points in The Six Dumbest Ideas in Computer Security. Though closely related, the first two apply directly to your question.

  • 1) Default Permit - This is your current approach as all requests are allowed except the few filenames/extensions/etc that are being explicitly denied. It is far easier and far more secure to block everything and only allow the known valid requests. There are many website spiders available that will crawl all available links. Once a list of URLs is produced, you can go through it and pick out those that only end-users should be accessing. This is also an opportunity to ensure the website isn't inadvertently advertising restricted pages (i.e. admin only).

  • 2) Enumerating Badness - It is far easier implement a "Default Deny" and only allow known-good requests then to have rules for every possible bad request. If your website is running PHP, you don't want to manage rules to block requests for Ruby, Java, ASP, etc. Not only is that unnecessary work, managing a list that large is prone to misconfiguration especially typos.

A positive side effect is you will probably see a performance increase since only known-good requests will be allowed to traverse the entire stack.

3

On the web servers I run, I deny access to any type of server log files and sensitive files that contain web app configuration details such as WordPress's wp-config.php file

However, if you're running a website, denying access to PHP, HTML, CSS, in addition to some other file types would render your website unusable since browsers need to access those files in order to properly display your website.

Additionally, I would look into correctly setting file permissions for your files to ensure that only proper users have access to view, edit, and move them.

Finally, I would recommend whitelisting file types instead of blacklisting them because generally, there will be less room for error and it won't take up a lot of space in your .htaccess file or server blocks.

Whitelist File Types in Apache

Whitelist File Types in Nginx

1

Assuming you're using a decent language & framework, the only URLs that are accessible are the routes you defined. Everything else should get 404'd by default, except perhaps static non-sensitive files in a specific directory.

Anything sensitive should be out of reach of the web server anyway and should only be proxied by the application should it choose to do so.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.