Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have just setup a minimal (hopefully secure? - comments welcome) apache website using the following configuration file:

<VirtualHost *:80>
        ServerName foobar.com
        ServerAlias www.foobar.com
        ServerAdmin webmaster@foobar.com
        DocumentRoot /path/to/websites/foobar/web
        DirectoryIndex index.php

        # CustomLog with format nickname
        LogFormat "%h %l %u %t \"%r\" %>s %b" common
        CustomLog "|/usr/bin/cronolog /var/log/apache2/%Y%m.foobar.access.log" common

        LogLevel notice
        ErrorLog "|/usr/bin/cronolog /var/log/apache2/%Y%m.foobar.errors.log"

        <Directory />
                AllowOverride None
                Order Deny,Allow
                Deny from all
        </Directory>

        <Directory /path/to/websites/>
                Options -Indexes FollowSymLinks MultiViews
                AllowOverride None
                Order allow,deny
                allow from all
        </Directory>
</VirtualHost>

I am able to access the website by using www.foobar.com, however when I type foobar.com, I get the error 'Server not found' - why is this?

My second question concerns the security implications of the directive:

<Directory /path/to/websites/>
        Options -Indexes FollowSymLinks MultiViews
        AllowOverride None
        Order allow,deny
        allow from all
</Directory>

in the configuration above. What exactly is it doing, and is it necessary?. From my (admitedly limited) understanding of Apache configuration files, this means that anyone will be able to access (write to?) the /path/to/websites/ folder. Is my understanding correct? - and if yes, how is this not a security risk?

share|improve this question
    
Please only 1 problem per question :) –  Oliver Salzburg Mar 28 '12 at 11:31
    
Question 2: no, this has nothing to do with write access, only viewing access for your visitors. If you want them to be able to get served the indicated pages by Apache, they must have viewing access. It is not the same as read access on an OS level. –  Daniel Andersson Mar 28 '12 at 13:11

1 Answer 1

Regarding question 1, is the DNS for @ (ie. foobar.com) definitely pointing to the same site.

1) Check your DNS A records. 2) If you ping them, does it resolve to the same IP? 3) Is it your apache instances saying server not found?

share|improve this answer
    
+1 for useful feedback that can actually help me resolve the problem. I have checked my DNS A records and the record format is exactly the same as the other sites I am hosting on that domain. When I ping both foobar.com and www.foobar, it resolves and replies with the same IP address. I don't understand your 3rd question - please clarify –  Homunculus Reticulli Mar 28 '12 at 20:27
    
What is produced the "Server not found" error, is it your webserver saying it, or is it as though the host doesn't exist at all? –  digitalhen Apr 19 '12 at 9:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.