Apache Config Generator

Foswiki version

• A configuration created for 1.0 will still work with 1.1, but some new features may be missing from the configuration.
• A 1.1 configuration will work with 1.0, but 1.0 doesn't support all the features.

Base server information

Before you enable mod_perl in your webserver, you have to configure Foswiki. Otherwise, you'll face a chicken-and-egg problem, and would get something like this in your Apache error logs:

[error] Content-type: text/plain\n\nPerl error when reading LocalSite.cfg: \nPlease inform the site admin.\nBEGIN failed--

Before you enable fastcgi in your webserver, you should install the FastCGIEngineContrib using the Extensions: Install and update Extensions tool. The server will run, but all of the Foswiki scripts will fail with foswiki.fcgi not found until the Extension is installed.

Security related settings

Protect the bin/configure command

Foswiki login support

Attachments

• Note that this option can have a significant impact on performance.
• Also, this option is incompatible with ImageGalleryPlugin as it writes to /pub/images which is not a valid web name.
• Viewfile sets the mime type based upon file name suffix. Unknown types are served as text/plain which can result in corrupt files.
• This option will also add some rewrite rules that bypass viewfile for certain graphics files - review the comments in the configuration carefully!

Spiders and Robots

# Autogenerated httpd.conf file for Foswiki.
# Generated at http://foswiki.org/Support/ApacheConfigGenerator?vhost=;port=;dir=/var/www/foswiki;symlink=;pathurl=/foswiki;shorterurls=enabled;engine=CGI;fastcgimodule=fastcgi;apver=2;allowconf=;requireconf=;loginmanager=None;htpath=;errordocument=UserRegistration;errorcustom=;phpinstalled=PHP4;blockpubhtml=;blocktrashpub=;controlattach=;blockspiders=;foswikiversion=1.1

# For Foswiki version 1.1






# The Alias defines a url that points to the root of the Foswiki installation.
# The first parameter will be part of the URL to your installation e.g.
# http://my.co.uk/foswiki/bin/view/...
# The second parameter must point to the physical path on your disc.

ScriptAlias /foswiki/bin "/var/www/foswiki/bin"

# The following Alias is used to access files in the pub directory (attachments etc)
# It must come _after_ the ScriptAlias.  
# If short URLs are enabled, and any other local directories or files need to be accessed directly, they 
# must also be specified in an Alias statement, and must not conflict with a web name.  

Alias /foswiki/pub "/var/www/foswiki/pub"
Alias /foswiki/robots.txt "/var/www/foswiki/robots.txt"



#  Rewriting is required for Short URLs, and Attachment redirecting to viewfile
RewriteEngine    on
#RewriteLog "/var/log/apache/rewrite.log"  
#RewriteLogLevel 0   
 


# short urls
Alias /foswiki "/var/www/foswiki/bin/view"
RewriteRule ^/+foswiki/+bin/+view/+(.*) /foswiki/$1 [L,NE,R]
RewriteRule ^/+foswiki/+bin/+view$ /foswiki/ [L,NE,R]





# This enables access to the documents in the Foswiki root directory
<Directory "/var/www/foswiki">
    Order Allow,Deny
    Allow from all
    Deny from env=blockAccess
</Directory>



# This specifies the options on the Foswiki scripts directory. The ExecCGI
# and SetHandler tell apache that it contains scripts. "Allow from all"
# lets any IP address access this URL.
# Note:  If you use SELinux, you also have to "Allow httpd cgi support" in your SELinux policies

<Directory "/var/www/foswiki/bin">
    AllowOverride None
    Order Allow,Deny
    Allow from all
    Deny from env=blockAccess

    Options +ExecCGI  -FollowSymLinks
    SetHandler cgi-script

    # Password file for Foswiki users
    AuthUserFile "/var/www/foswiki/data/.htpasswd"
    AuthName 'Enter your WikiName: (First name and last name, no space, no dots, capitalized, e.g. JohnSmith). Cancel to register if you do not have one.'
    AuthType Basic

    # File to return on access control error (e.g. wrong password)
    ErrorDocument 401 /foswiki/System/UserRegistration

    # Limit access to configure to specific IP address(es) and user(s).
    # Make sure configure is not open to the general public.
    # It exposes system details that can help attackers.
    # cf. http://foswiki.org/Support/ProtectingYourConfiguration for details.
    <FilesMatch "^(configure)$">
        SetHandler cgi-script
        
        Satisfy All
        ErrorDocument 401 default
    </FilesMatch>

</Directory>

# This sets the options on the pub directory, which contains attachments and
# other files like CSS stylesheets and icons. AllowOverride None stops a
# user installing a .htaccess file that overrides these options.
# Note that files in pub are *not* protected by Foswiki Access Controls,
# so if you want to control access to files attached to topics you need to
# block access to the specific directories same way as the ApacheConfigGenerator
# blocks access to the pub directory of the Trash web
<Directory "/var/www/foswiki/pub">
    Options None
    Options -FollowSymLinks
    AllowOverride None
    Order Allow,Deny
    Allow from all
    Deny from env=blockAccess
    ErrorDocument 404 /foswiki/bin/viewfile

    # Disable execution of PHP scripts
    php_admin_flag engine off

    # This line will redefine the mime type for the most common types of scripts
    AddType text/plain .shtml .php .php3 .phtml .phtm .pl .py .cgi
   #
   #add an Expires header that is sufficiently in the future that the browser does not even ask if its uptodate
   # reducing the load on the server significantly
   #IF you can, you should enable this - it _will_ improve your Foswiki experience, even if you set it to under one day. 
   # you may need to enable expires_module in your main apache config
   #LoadModule expires_module libexec/httpd/mod_expires.so
   #AddModule mod_expires.c
   #<ifmodule mod_expires.c>
   #  <filesmatch "\.(jpe?g|gif|png|css(\.gz)?|js(\.gz)?|ico)$">
   #       ExpiresActive on
   #       ExpiresDefault "access plus 11 days"
   #   </filesmatch>
   #</ifmodule>
   #
   # Serve pre-compressed versions of .js and .css files, if they exist
   # Some browsers do not handle this correctly, which is why it is disabled by default
   # <FilesMatch "\.(js|css)$">
   #         RewriteEngine on
   #         RewriteCond %{HTTP:Accept-encoding} gzip
   #         RewriteCond %{REQUEST_FILENAME}.gz -f
   #         RewriteRule ^(.*)$ %{REQUEST_URI}.gz [L,QSA]
   # </FilesMatch>
   # <FilesMatch "\.(js|css)\?.*$">
   #         RewriteEngine on
   #         RewriteCond %{HTTP:Accept-encoding} gzip
   #         RewriteCond %{REQUEST_FILENAME}.gz -f
   #         RewriteRule ^([^?]*)\?(.*)$ $1.gz?$2 [L]
   # </FilesMatch>
   # <FilesMatch "\.js\.gz(\?.*)?$">
   #         AddEncoding x-gzip .gz
   #         AddType application/x-javascript .gz
   # </FilesMatch>
   # <FilesMatch "\.css\.gz(\?.*)?$">
   #         AddEncoding x-gzip .gz
   #         AddType text/css .gz
   # </FilesMatch>


</Directory>

# Security note: All other directories should be set so
# that they are *not* visible as URLs, so we set them as =deny from all=.
<Directory "/var/www/foswiki/data">
    deny from all
</Directory>

<Directory "/var/www/foswiki/templates">
    deny from all
</Directory>

<Directory "/var/www/foswiki/lib">
    deny from all
</Directory>

<Directory "/var/www/foswiki/locale">
    deny from all
</Directory>

<Directory "/var/www/foswiki/tools">
    deny from all
</Directory>

<Directory "/var/www/foswiki/working">
    deny from all
</Directory>

# We set an environment variable called blockAccess.
#
# Setting a BrowserMatchNoCase to ^$ is important. It prevents Foswiki from
# including its own topics as URLs and also prevents other Foswikis from
# doing the same. This is important to prevent the most obvious
# Denial of Service attacks.
#
# You can expand this by adding more BrowserMatchNoCase statements to
# block evil browser agents trying to crawl your Foswiki
#
# Example:
# BrowserMatchNoCase ^SiteSucker blockAccess
# BrowserMatchNoCase ^$ blockAccess



BrowserMatchNoCase ^$ blockAccess