Issues with modifying htaccess file

[heifer]

hi,
I'm trying to modify the .htaccess file. I've followed the FAQ on "How can i block specific hacker activity", however when i modify my htaccess file and then upload it back to my folder it blocks my admin login page as well. Looking at the code that I am supposed to add according to the FAQ, it doesn't say to redirect the "/admin" folder to page not found.

"
// redirects any URL that includes: record_company.php/password_forgotten.php
RedirectMatch Permanent ^/(.*[record_company.php]+)/(password_forgotten.php)$ /page_not_found.php

// redirects any URL that includes: /images/wp- with 'wp-' being anything that ends with '.php'
// this allows for images named such as 'wp-header.jpg' to work
RedirectMatch Permanent ^/(.*[images]+)/(wp-.*\.php)$ /page_not_found.php
"


Please help. I'd like to close off these security holes. Thanks!

[mprough]

That is not how you would go about "blocking those holes".

First and foremost you patch your cart fully, http://www.zen-cart.com/forum/showthread.php?t=131115

Next you do this http://www.zen-cart.com/wiki/index.p...ecommendations , pay close attention to the htaccess section

~Melanie

[Website Rob]

The FAQ you copied from needs to be updated as part of it is wrong.

Should be:

## redirects any URL that includes: record_company.php/password_forgotten.php
RedirectMatch Permanent ^/(.*[record_company.php]+)/(password_forgotten.php)$ /page_not_found.php

## redirects any URL that includes: /images/wp- with 'wp-' being anything that ends with '.php'
## this allows for images named such as 'wp-header.jpg' to work
RedirectMatch Permanent ^/(.*[images]+)/(wp-.*\.php)$ /page_not_found.php


The # sign allows one to include comments which Apache will ignore but are helpful to one trying to figure out what the code does.

[heifer]

thanks mprough and Website Rob!

I've got everything patched now.

I'm using dreamhost and created an htaccess file using their tool. It has solved the problem of snooping and getting to the directories within "admin" without entering a password.

However, the problem of getting to the directories within the "admin" folder is still there. Now a password will need to be entered, but how can i make it so it redirects to the "page not found" instead of giving people the login page.

I tried adding the code to the htaccess file and uploading it, but the permissions aren't sufficient enough to modify this file.

In the htaccess file, it specifically says do not modify because it's done by dreamhost. Will it break my website if i try to add the code described in the earlier post to the htaccess file and upload (after modding the permissions)?

[Website Rob]

There is no need to edit or change the default .htaccess files within any of the Admin dir. Changes and additions to any .htaccess file should be for:

public_html/.htaccess
or
public_html/images/.htaccess

The one quoted in your first post is for: public_html/.htaccess

[heifer]

Thanks Website Rob.

I will give it a try. It looks like there is no .htaccess file in the /public domain, so i will have to create one to upload. I'm just worried that it may lock me out again. If it fails, can I just upload a blank htaccess file back to the /public domain? Because I don't know how i can delete it. Sorry, I'm not too familiar with htaccess file.

[Website Rob]

With any file that is giving you a problem, renaming it will solve the problem.

In this case, renaming .htaccess to .htaccess1 will prevent it from working and thus, any directives/code within it. Rename it back to .htaccess to have it work again.

[heifer]

i tried it and it still doesn't redirect. Not sure what i'm doing wrong here...

[Website Rob]

You should restate what it is you are trying to do and what you've done so far to achieve that result.

[heifer]

I'm trying to prevent people from simply guessing the new "admin" folder name and then getting to the pages such as public_url/admin/record_company.php or public_url/admin/password_forgotten.php.
I'd like to do a redirect to a page not found.php


The code that I have in the .htaccess file is
## redirects any URL that includes: record_company.php/password_forgotten.php
RedirectMatch Permanent ^/admin/(.*[record_company.php]+)/(password_forgotten.php)$ /page_not_found.php

## redirects any URL that includes: /images/wp- with 'wp-' being anything that ends with '.php'
## this allows for images named such as 'wp-header.jpg' to work
RedirectMatch Permanent ^/admin/(.*[images]+)/(wp-.*\.php)$ /page_not_found.php

I've put the .htaccess file in the root folder, and I've also put it into the admin folder. However, it doesn't seem to redirect to the page not found php. The page not found php file have been in the same folder as where I have put the .htaccess file.