How can I make my apache configuration file visible in a web page?

Question

How can I make my apache configuration file visible in a web page ? Is there a short way to do it ?

Is that safe? I mean.. it should be visible only to me ? Or it is reasonably ok, if nobody knows which page it is ?

Answer 1

Whether it is safe or not depends on your specific Apache configuration. But really you shouldn't expose configuration details of any system to the public at large, unless you have a very specific need to do so (i.e. you're running a website about Apache security and using the website itself for an example).

Nonetheless, if you really want to do it, just make a symbolic link in your web directory to your configuration file. Something like:

ln -s /etc/apache2/apache2.conf /var/www/apache2.conf

Then users can enter http://www.yourdomain.example/apache2.conf and see it. Of course your configuration file has to be world-readable.

Note that there is usually more to the Apache configuration than just that file, you'd have to expose the entire /etc/apache2 conf (ln -s /etc/apache2 /var/www/my-apache-configuration-directory) if you want the full configuration visible.

Now, if what you meant is you want the configuration file to show up as part of a web page, basically you'll need a CGI script or other executable that builds the web page and includes the contents of that file as part of that process. Or you can create a external script that builds that web page and then just dumps an HTML file somewhere. You can have this script run via cron every so often (once a day?) to check for updates to your file, or if you're using Linux you can do some elaborate stuff with inotify and have it call the rebuild script whenever you modify the file. Or you can go the easy route and use server side includes.

But really, it's a bad idea. Don't do it.

Answer 2

No it's not safe, the www (or whatever user apache is running as) user should not be able to read files outside the web tree.

The best way would be to copy the file to the a sub dir of the web-root (perhaps doing it periodical with cron) and protect it using .htaccess

Answer 3

My question would be why would you need to expose this externally? Apache pretty much should be a 'set and forget' server. I don't want to presume too much, but my first guess is, if you want to do this there's something wrong in your Apache model. Why would you need to see it (yet not be able to change it) at a distance, or often enough to make this worth the work needed to get it out. Config files can include other config files and you'd need to make all of these exposed to make sure you can see everything involved in configuration.

And yes, this can be dangerous. It's a HUGE information leak to attackers on what your config is. If you have an insecure config, you'd expose it. If you want to do this, please lock it down. Don't assume that by not linking to this file people won't find it. If you do anything like this, create a directory for it and lock it down with passwords, IP restrictions, or both.

I have two suggestions for you. One is to expose the subset of config that's available through the module mod_info. There's a config already in the default httpd.conf that maps the URL /server-info to mod_info module, but it's commented out by default. Be sure to understand the Allow/Deny configs for it and lock it down to where just you can see the data. It doesn't expose as much as the true configs would, but it should be locked down.

Also, look at Webmin, its a way of configuring a UNIX machine, including Apache. You'd be able to configure remotely. Obviously this takes a lot more to get to work.