Re: AliasMatch ^/(.*) /$1 -- WEB400

Hi Frank

Sorry for any confusion.

One thing I know is, there are no default AliasMatch directives when a server instance is created using the admin browser interface.

So I don't know why it's there - it still strikes me as a possible security hole. Of course, security is established in each <directory> directive, and this doesn't expose anything until you specify those containers (that's what it's called, right? when you use the <directory? thing).

So maybe it's a convenience to be able easily to add access to folders outside of DocumentRoot - I used an AliasMatch root in the Apache server running on my PC to point to a directory on an entirely different drive.

Vern

On 1/29/2013 10:00 AM, fbocch2595@xxxxxxx wrote:

Hi Vern, that's confusing but...a lot of the server stuff is...but it all seems to work. My guess is that the statement AliasMatch ^/(.*) /$1 is in all our /www/apache/conf/httpd.conf's because it's a default and also the same with "Allow From all" which I see several times in teh conf and I'm assuming that's the default too.
Thanks for the info, Frank

-----Original Message-----
From: Vernon Hamberg <vhamberg@xxxxxxxxxxxxxxx>
To: Web Enabling the IBM i (AS/400 and iSeries) <web400@xxxxxxxxxxxx>
Sent: Mon, Jan 28, 2013 4:13 pm
Subject: Re: [WEB400] AliasMatch ^/(.*) /$1

Frank
As far as I know, this is weird - it has this effect -
The regular expression that defines the match is (.*) - this means any
haracter (the dot) repeated (the asterisk) will be saved as a value
hat can be used later in the expression (the parentheses) and it is the
irst one, so that replacement marker will be $1.
The caret means the end of the URL including port, maybe - actually the
eginning of what follows that - weird way to describe - sorry.
So this means that if you put the word home at the end of a URL, as here -
http://some.url.com:port/home
it will try to work with things in the
/home
directory in the IFS.
But then you either need a container (<directory> directive) for either
he root of the IFS or for the home directory, to define access to
ontents of that directory - but this is ultra generic - that's why I
hink it's weird. Maybe even a security issue, but I'm not sure of that.
Is there also in the httpd.conf a <directory> entry that looks like
<directory />
and is there an "allow all" in there?
If so, it's a gaping hole, again, so far as I know!!
Now the web admin would NOT put this in on its own, that I know of.
That's all I know on a Monday.
HTH
ern
On 1/28/2013 1:19 PM, fbocch2595@xxxxxxx wrote:

Hi Folks, I'm working with biz partners who are asking me how AliasMatch
/(.*) /$1
got in /www/apache/conf/httpd.conf. I'm assuming that AliasMatch ^/(.*) /$1
as added by the OS (licpgm's?)...is that true? If anyone want to explain what
he AliasMatch ^/(.*) /$1 statement is plz do but not necessary. We don't use
lias names as far as I know since the server properties don't show AliasMatch
/(.*) /$1 on any of the screens except as an example, when I view my servers
ia http://172.1.1.111:2001/HTTPAdmin
Is it typical to have /www/apache/conf/httpd.conf contain AliasMatch ^/(.*)
$1?

Thanks, Frank