Apache configuration
Prev | Appendix B. Security | Next

## Apache configuration

LAM includes several .htaccess files to protect your configuration files and temporary data. Apache is often configured to not use .htaccess files by default. Therefore, please check your Apache configuration and change the override setting to:

AllowOverride All

If you are experienced in configuring Apache then you can also copy the security settings from the .htaccess files to your main Apache configuration.

If possible, you should not rely on .htaccess files but also move the config and sess directory to a place outside of your WWW root. You can put a symbolic link in the LAM directory so that LAM finds the configuration/session files.

Security sensitive directories:

config: Contains your LAM configuration and account profiles

- LAM configuration passwords (SSHA hashed)

- default values for new accounts

- directory must be accessibly by Apache but needs not to be accessible by the browser

sess: PHP session files

- LAM admin password in clear text or MCrypt encrypted

- cached LDAP entries in clear text or MCrypt encrypted

- directory must be accessibly by Apache but needs not to be accessible by the browser

tmp: temporary files

- PDF documents which may also include passwords

- images of your users

- directory contents must be accessible by browser but directory itself needs not to be browseable

Prev | Up | Next
Protection of your LDAP password and directory contents | Home | Appendix C. Recommended OpenLDAP settings