How do I set .htaccess so people can't see cron.sh and mage?

Question

How do I set .htaccess so people can't see cron.sh and mage?

I kind of feel like nobody should be able to get to anything except index.php from the outside. Yet Magento's default .htaccess file has this stuff:

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-l

So the question is how do you block people from being able to get to cron.sh and mage and stuff like that? It's really not cool that people can just go right to these.

I would think something like this would be appropriate:

<Files cron.sh>
    order allow,deny
    allow from 127.0.0.1
    deny from all
</Files>

So that way crontab can still access cron.sh but it can't be called from the outside. Am I on the right rack here? How are people dealing with this?

Answer 1

Yes looks like it but I don't think you will be calling the cron.sh from a browser so no need for:

 allow from localhost

I'd just do the following

  <Files cron.sh>
        order allow,deny
        deny from all
  </Files>

Also I'd look at permissions and on the file and possibly change it's owner/group to a different user than the webserver's users.

EDIT

You shouldn't need to edit you .htaccess file to stop access. Just follow the recommended file permissions found here http://www.magentocommerce.com/wiki/groups/227/resetting_file_permissions