0

I want to understand security implications of changing DocumentRoot in Apache to an installed website versus adding a RewriteRule.

The reason I ask this, I have a website that is installed under /var/www/html/website/. I initially changed the DocumentRoot to /var/www/html/website in the 000-default-le-ssl.conf file. This however, exposed certain elements during an NMAP scan. Specifically JS and CSS files. Examples:

https://ipaddress/nextcloud/core/js/contactsmenu.js?v=6e38f86c-7 https://IPaddress/nextcloud/core/css/guest.css?v=6e38f86c-7

and few more.

I considered this insecure behavior and hence added the following as part of the 000-default-le-ssl.conf configuration file.

I changed DocumentRoot to /var/www/html and added:

RewriteEngine on
RewriteCond %{REQUEST_URI} ^/$
RewriteRule (.*) /nextcloud/ [R=301]

Hence my question, is there any security benifit of changing DocumentRoot to default and adding a redirect or is the end result the same?

Also, I know this is product specific (nextcloud), but should such files be visible?

|improve this question
  • 2
    "I considered this insecure behavior..." - for what reason? Just because something comes up from a nmap scan does not mean that this is a problem. With this argument you should probably shutdown your whole server since nmap will report the port as open otherwise. At the end all what is relevant is if there are sensitive data accessible by unauthorized users or can unauthorized users do otherwise harm - which has nothing to do with DocumentRoot per se. – Steffen Ullrich Mar 30 at 6:18
  • You're right, I'm not aware of specific reason(s) and hence based on my limited knowledge I called it insecure. If you can help me understand genuineness of the threat, I'd be thankful. – Parth Maniar Mar 30 at 6:21
  • It will only fool nmap and it's something small but better than nothing. – Aria Mar 30 at 11:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.