Skip to main content
mvierow
Inspiring
December 3, 2021
Question

Auto Lockdown too aggressive on Apache

  • December 3, 2021
  • 0 replies
  • 110 views

Auto Lockdown adds a few RedirectMatch rules to prevent accessing certain parts of your install when securing an Apache install. A few of the regex's used in these rules are too generic. For instance:

RedirectMatch 404 (?i).*.svn.*
RedirectMatch 404 (?i).*.git.*

The unescaped period and lack of a leading directory separator makes these rules too generic. In particular, the .git expression matches a common words like digit or digital. These were added with the 2021 lockdown tool I downloaded on October 11th and I'm not sure how long they've been added. 

This topic has been closed for replies.