From 55b2bc486686f5dc81d6a9135cbde96c9388a62d Mon Sep 17 00:00:00 2001 From: Paul Querna Date: Sat, 4 Sep 2004 01:38:24 +0000 Subject: [PATCH] updated mod_info to include docs on the different arguments it can take. Submitted By: Rici Lake git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@104947 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/mod/mod_info.html.en | 127 ++++++++++++++++++++++--------- docs/manual/mod/mod_info.xml | 123 +++++++++++++++++++++--------- 2 files changed, 179 insertions(+), 71 deletions(-) diff --git a/docs/manual/mod/mod_info.html.en b/docs/manual/mod/mod_info.html.en index d3bbb503a09..c612e27f804 100644 --- a/docs/manual/mod/mod_info.html.en +++ b/docs/manual/mod/mod_info.html.en @@ -42,47 +42,104 @@ configuration </Location>

-

You may wish to add a - <Limit> - clause inside the - <Location> - directive to limit access to your server configuration - information.

-

Once configured, the server information is obtained by accessing http://your.host.dom/server-info

- -
- Note that the configuration files are read by the - module at run-time, and therefore the display may - not reflect the running server's active - configuration if the files have been changed since the server - was last reloaded. Also, the configuration files must be - readable by the user as which the server is running (see the - User directive), or - else the directive settings will not be listed. - -

It should also be noted that if - mod_info is compiled into the server, its - handler capability is available in all configuration - files, including per-directory files (e.g., - .htaccess). This may have security-related - ramifications for your site.

- -

In particular, this module can leak sensitive information - from the configuration directives of other Apache modules such as - system paths, usernames/passwords, database names, etc. Due to - the way this module works there is no way to block information - from it. Therefore, this module should only be - used in a controlled environment and always with caution.

-

Directives

-
+

Topics

+ +
top
+
+

Security Issues

+

Once mod_info is loaded into the server, its + handler capability is available in all configuration + files, including per-directory files (e.g., + .htaccess). This may have security-related + ramifications for your site.

+ +

In particular, this module can leak sensitive information + from the configuration directives of other Apache modules such as + system paths, usernames/passwords, database names, etc. Therefore, + this module should only be + used in a controlled environment and always with caution.

+

You will probably want to use mod_access + to limit access to your server configuration information.

+ +

Access control

+ <Location /server-info>
+ + SetHandler server-info
+ Order allow,deny + # Allow access from server itself + Allow from 127.0.0.1 + # Additionally, allow access from local workstation + Allow from 192.168.1.17 + + </Location> +

+
top
+
+

Selecting the information shown

+

By default, the server information includes a list of + all enabled modules, and for each module, a description of + the directives understood by that module, the hooks implemented + by that module, and the relevant directives from the current + configuration.

+ +

Other views of the configuration information are available by + appending a query to the server-info request. For + example, http://your.host.dom/server-info?config + will show all configuration directives.

+ +
+
?<module-name>
+
Only information relevant to the named module
+
?config
+
Just the configuration directives, not sorted by module
+
?list
+
Only a simple list of enabled modules
+
?server
+
Only the basic server information
+
+
top
+
+

Known Limitations

+

mod_info provides its information by reading the + parsed configuration, rather than reading the original configuration + file. There are a few limitations as a result of the way the parsed + configuration tree is created:

+ +
top

AddModuleInfo Directive

@@ -101,8 +158,8 @@ information displayed by the server-info handler

AddModuleInfo mod_deflate.c 'See <a \
- href="http://www.apache.org/docs-2.1/mod/mod_deflate.html">\
- http://www.apache.org/docs-2.1/mod/mod_deflate.html</a>' + href="http://www.apache.org/docs-2.1/mod/mod_deflate.html">\
+ http://www.apache.org/docs-2.1/mod/mod_deflate.html</a>'

diff --git a/docs/manual/mod/mod_info.xml b/docs/manual/mod/mod_info.xml index ca16eecf4f4..a3b64759697 100644 --- a/docs/manual/mod/mod_info.xml +++ b/docs/manual/mod/mod_info.xml @@ -1,7 +1,7 @@ - +