Protecting config files

[jnewb]

Hello, I'm a newbie to Cacti and Linux. I have created some config files. The files are all located in /usr/share/cacti/plugins/weathermap/configs. I have found that I am able to access those config files directly via a web browser (e.g. http://<IP address of cacti server>/cacti/plugins/weathermap/configs/test.conf). Is there a way to make those config files inaccessible via web browser or somehow password protect them?

[Howie]

What webserver do you use? There's already a .htaccess file for Apache in the configs folder that would normally stop web access.

If you use Apache, you might need to add "AllowOverride" to your Apache config so that it takes notice of the .htaccess file. Here's a link for how that works on Ubuntu /Debian: https://ubuntuforums.org/showthread.php?t=1506129

(On other Linux, it will be different: sites-available is a specific Debian/Ubuntu thing)

[jnewb]

I'm using Apache v2.4.6. I found some info on the web about password protecting folders using the .htaccess and .htpasswd files. But those didn't work for me. After looking at the link in the last response, I changed httpd.conf.

Currently, I have the following set in /etc/httpd/conf/httpd.conf.

<Directory "/var/www">
Options Indexes Includes FollowSymLinks MultiViews
AllowOverride All
Order allow,deny
Allow from all
</Directory>

FYI - after each change to httpd.conf, I restarted Apache using the command "apachectl restart".

I can still access the config file via web browser.

[Howie]

This isn't really a weathermap issue...

OK, so what directory is Weathermap in? (Is it below /var/www somewhere, or in /usr/share or similar where Ubuntu sometimes puts things)

And do you still have the original (from the zip) .htaccess in the configs/ folder?

[jnewb]

FYI - I'm running Centos 7.

Weathermap is in /usr/share/cacti/plugins/weathermap.

Yes, I have the original .htaccess in the configs folder.

[Howie]

OK, so adding 'AllowOverride all' to /var/www is not going to affect /usr/share

Have a look through /etc/httpd/conf/httpd.conf and /etc/httpd/conf.d/*.conf for another <Directory> mentioning /usr/share

If there isn't one, you probably want to create a new file /etc/httpd/conf.d/weathermap.conf containing:

Code: Select all

<Directory "/usr/share/cacti/plugins/weathermap">
AllowOverride All
</Directory>

or something similar. Then restart Apache.

I expect that you might already have something like /etc/httpd/conf.d/cacti.conf

[jnewb]

I created a weathermap.conf file. That worked! I get a prompt for password to access config files now. Thank you Howie!! You're awesome!