Issues with modifying htaccess file

hi,
I'm trying to modify the .htaccess file. I've followed the FAQ on "How can i block specific hacker activity", however when i modify my htaccess file and then upload it back to my folder it blocks my admin login page as well. Looking at the code that I am supposed to add according to the FAQ, it doesn't say to redirect the "/admin" folder to page not found.

"
// redirects any URL that includes: record_company.php/password_forgotten.php
RedirectMatch Permanent ^/(.*[record_company.php]+)/(password_forgotten.php)$ /page_not_found.php

// redirects any URL that includes: /images/wp- with 'wp-' being anything that ends with '.php'
// this allows for images named such as 'wp-header.jpg' to work
RedirectMatch Permanent ^/(.[images]+)/(wp-..php)$ /page_not_found.php
"

Please help. I'd like to close off these security holes. Thanks!

That is not how you would go about "blocking those holes".

First and foremost you patch your cart fully, http://www.zen-cart.com/forum/showthread.php?t=131115

Next you do this http://www.zen-cart.com/wiki/index.php/Important_Site_Security_Recommendations , pay close attention to the htaccess section

~Melanie

The FAQ you copied from needs to be updated as part of it is wrong.

Should be:

redirects any URL that includes: record_company.php/password_forgotten.php

RedirectMatch Permanent ^/(.*[record_company.php]+)/(password_forgotten.php)$ /page_not_found.php

redirects any URL that includes: /images/wp- with 'wp-' being anything that ends with '.php'

this allows for images named such as 'wp-header.jpg' to work

RedirectMatch Permanent ^/(.[images]+)/(wp-..php)$ /page_not_found.php

The # sign allows one to include comments which Apache will ignore but are helpful to one trying to figure out what the code does.

thanks mprough and Website Rob!

I've got everything patched now.

I'm using dreamhost and created an htaccess file using their tool. It has solved the problem of snooping and getting to the directories within "admin" without entering a password.

However, the problem of getting to the directories within the "admin" folder is still there. Now a password will need to be entered, but how can i make it so it redirects to the "page not found" instead of giving people the login page.

I tried adding the code to the htaccess file and uploading it, but the permissions aren't sufficient enough to modify this file.

In the htaccess file, it specifically says do not modify because it's done by dreamhost. Will it break my website if i try to add the code described in the earlier post to the htaccess file and upload (after modding the permissions)?

There is no need to edit or change the default .htaccess files within any of the Admin dir. Changes and additions to any .htaccess file should be for:

public_html/.htaccess
or
public_html/images/.htaccess

The one quoted in your first post is for: public_html/.htaccess

Thanks Website Rob.

I will give it a try. It looks like there is no .htaccess file in the /public domain, so i will have to create one to upload. I'm just worried that it may lock me out again. If it fails, can I just upload a blank htaccess file back to the /public domain? Because I don't know how i can delete it. Sorry, I'm not too familiar with htaccess file.

With any file that is giving you a problem, renaming it will solve the problem.

In this case, renaming .htaccess to .htaccess1 will prevent it from working and thus, any directives/code within it. Rename it back to .htaccess to have it work again.

i tried it and it still doesn't redirect. Not sure what i'm doing wrong here...

You should restate what it is you are trying to do and what you've done so far to achieve that result.

I'm trying to prevent people from simply guessing the new "admin" folder name and then getting to the pages such as public_url/admin/record_company.php or public_url/admin/password_forgotten.php.
I'd like to do a redirect to a page not found.php

The code that I have in the .htaccess file is
## redirects any URL that includes: record_company.php/password_forgotten.php
RedirectMatch Permanent ^/admin/(.[record_company.php]+)/(password_forgotten.php)$ /page_not_found.php

redirects any URL that includes: /images/wp- with 'wp-' being anything that ends with '.php'

this allows for images named such as 'wp-header.jpg' to work

RedirectMatch Permanent ^/admin/(.[images]+)/(wp-..php)$ /page_not_found.php*

I've put the .htaccess file in the root folder, and I've also put it into the admin folder. However, it doesn't seem to redirect to the page not found php. The page not found php file have been in the same folder as where I have put the .htaccess file.

The code does not need to be in the Admin .htaccess file as by definition, you have renamed it so people will not know what it is.

As to not redirecting, you can always be more forceful by changing:

/page_not_found.php

to

http://yourdomain.com/page_not_found.php

You seem to be very worried, how about this...

Restore your default admin htaccess so you don't have any problems

Then add the following to it using your IP address

Now only your IP address can access admin, others will get a forbidden if they discover its folder name

~Melanie