Apache Configuration. Magento Your web server is configured incorrectly

Question

Right now I am facing some problems with my web server running Magento CE 1.9.2.1. In adminhtml I do get the security message, that says my web server seems to be configured incorrectly.

I’ve done almost everything to solve the problem. The answer of this post seems to be the most common solution for everybody (Apache Configuration local.xml warning)

I’ve checked the .htaccess files in root, app, var, lib etc. and everything will be blocked correctly with a 403 by .htaccess if one tries to get those data through the webserver (like BASE-URL/app/etc/local.xml). I do also get a new entry in my apache log that says, that the access was (successfully) denied by server configuration.

In the default server configuration, vhost configuration and .htaccess I made sure, that I entered

Options FollowSymlinks
AllowOverride All
for the <Directory "srv/www/htdocs"></Directory>

My file permissions were set to

find . -type f -exec chmod 644 {} \;
find . -type d -exec chmod 755 {} \;
chmod 550 mage
chmod 550 cron.sh
chmod 550 app/etc/local.xml (also tried 644 and 600)
chmod 550 app/etc/config.xml (also tried 644 and 600)

I do still get this security message in my backend. Does anybody know a solution for this problem?

Answer 1

if you able to open your app/etc/local.xml then there is something wrong with .htaccess rules.

just to make sure add this to your apache config:

<Directory /srv/www/htdocs/>
        Options -Indexes
</Directory>

<LocationMatch /(app|includes|pkginfo|var)/>
    Require all denied
</LocationMatch>

<FilesMatch "\.(sh|pl|phar|conf|sql)$">
    Require all denied
</FilesMatch>

<Directory ~ /(media|shell|skin|lib)/>
<FilesMatch "\.php$">
    Require all denied
</FilesMatch>
</Directory>

<LocationMatch /\.(svn|git|hg|gitignore)/?>
Require all denied
</LocationMatch>

<LocationMatch /cron\.php$>
    Require all denied
</LocationMatch>

Answer 2

I'm with the same problem, the Apache is executed after nginx.

To test the problem I had searched the code that test it and I found it:

private function _isFileAccessible()
{
    $defaultUnsecureBaseURL = (string) Mage::getConfig()->getNode('default/' . Mage_Core_Model_Store::XML_PATH_UNSECURE_BASE_URL);
    $http = new Varien_Http_Adapter_Curl();
    $http->setConfig(array('timeout' => $this->_verificationTimeOut));
    $http->write(Zend_Http_Client::POST, $defaultUnsecureBaseURL . $this->_filePath);
    $responseBody = $http->read();
    $responseCode = Zend_Http_Response::extractCode($responseBody);
    $http->close();

    return $responseCode == 200;
}

Then I changed to it:

$defaultUnsecureBaseURL = (string) Mage::getConfig()->getNode('default/' . Mage_Core_Model_Store::XML_PATH_UNSECURE_BASE_URL);
$defaultUnsecureBaseURL = "<URL TO UNSECURE BASE URL>";
$_verificationTimeOut = 150;
$_filePath = 'app/etc/local.xml';
$http = new Varien_Http_Adapter_Curl();
$http->setConfig(array('timeout' => $_verificationTimeOut));
$http->write(Zend_Http_Client::POST, $defaultUnsecureBaseURL . $_filePath);
$responseBody = $http->read();
$responseCode = Zend_Http_Response::extractCode($responseBody);
$http->close();
echo "<pre>";
print_r(array($defaultUnsecureBaseURL.$_filePath,$responseCode));
echo "</pre>";
echo "<pre>";
print_r(array($responseBody));
echo "</pre>";

With it I got the response:

Array
(
    [0] => <URL TO UNSECURE BASE URL>/app/etc/local.xml
    [1] => 200
)
Array
(
    [0] => HTTP/1.1 200 OK
Server: nginx
Date: Wed, 21 Dec 2016 04:44:59 GMT
Content-Type: text/xml
Content-Length: 0
Connection: keep-alive
Keep-Alive: timeout=15
)

With this new information someone knows what to do?