Disable UserDir functtionaility - apache httpd 2.2.29 mod_userdir disabled, but ~ queries still being served

Question

I have a server where I'm trying to disable the ~user behavior. I've forcibly disabled the mod_userdir module by renaming the .so from the modules directory. I confirmed that it doesn't load by leaving a "UserDir" directive in one of the confs, and seeing that a reload fails.

Further, I've checked the loaded modules and verified the module isn't listed:

apachectl -M
Loaded Modules:
 core_module (static)
 mpm_prefork_module (static)
 http_module (static)
 so_module (static)
 auth_basic_module (shared)
 auth_digest_module (shared)
 authn_file_module (shared)
 authn_alias_module (shared)
 authn_anon_module (shared)
 authn_dbm_module (shared)
 authn_default_module (shared)
 authz_host_module (shared)
 authz_user_module (shared)
 authz_owner_module (shared)
 authz_groupfile_module (shared)
 authz_dbm_module (shared)
 authz_default_module (shared)
 ldap_module (shared)
 authnz_ldap_module (shared)
 include_module (shared)
 log_config_module (shared)
 logio_module (shared)
 env_module (shared)
 ext_filter_module (shared)
 mime_magic_module (shared)
 expires_module (shared)
 deflate_module (shared)
 headers_module (shared)
 usertrack_module (shared)
 setenvif_module (shared)
 mime_module (shared)
 dav_module (shared)
 status_module (shared)
 autoindex_module (shared)
 info_module (shared)
 dav_fs_module (shared)
 vhost_alias_module (shared)
 negotiation_module (shared)
 dir_module (shared)
 actions_module (shared)
 speling_module (shared)
 alias_module (shared)
 substitute_module (shared)
 rewrite_module (shared)
 proxy_module (shared)
 proxy_balancer_module (shared)
 proxy_ftp_module (shared)
 proxy_http_module (shared)
 proxy_ajp_module (shared)
 proxy_connect_module (shared)
 cache_module (shared)
 suexec_module (shared)
 disk_cache_module (shared)
 cgi_module (shared)
 version_module (shared)
 passenger_module (shared)
 ssl_module (shared)
Syntax OK

But, if I query the server for my test file (~nobody/test), I still get a result back.

Is there some other module that is providing that feature? How do I turn it off?

Here is a link to the httpd.conf file (with conf.d/* merged in): https://www.dropbox.com/s/73htej25ffs9a20/httpd.conf_merged?dl=0

UPDATE:

I've narrowed down the cause to a specific conf.d file:

NameVirtualHost 987.654.32.1:8080

LoadModule passenger_module /app/rvm/gems/ruby-1.9.2-p290@bzd/gems/passenger-3.0.19/ext/apache2/mod_passenger.so
PassengerRoot /app/rvm/gems/ruby-1.9.2-p290@bzd/gems/passenger-3.0.19
PassengerRuby /app/rvm/wrappers/ruby-1.9.2-p290@bzd/ruby

<VirtualHost 987.654.32.1:8080>
  LogFormat "%{XFF_IP}e %{Host}i %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" \"[XFF=%{X-Forwarded-For}i]\" %D" cgm_fmt
  ServerName dashboard.foobar.com
  ServerAlias dashboard-alias.foobar.com
  DocumentRoot /app/dashboard/prod/current/public
  PassengerAppRoot /app/dashboard/prod/current
  RackBaseURI /
  RailsEnv 'production'
  PassengerLogLevel 3
  CustomLog "/var/log/httpd/dashboard_access-log" cgm_fmt
  ErrorLog "/var/log/httpd/dashboard_error-log"
  <Directory /app/dashboard/prod/current>
    Options FollowSymLinks
    AllowOverride all
    Order deny,allow
    Allow from all
    Options -MultiViews
    PassengerEnabled On
  </Directory>

  RewriteEngine on

  RewriteRule (.*) $1 [E=REDIRECT:TRUE]

  # always allow healthchecks
  RewriteCond %{REQUEST_URI} ^/healthcheck$
  RewriteRule (.*) $1 [E=REDIRECT:FALSE]

  RewriteCond %{HTTP_HOST} ^dashboard.foobar.com$
  RewriteRule (.*) $1 [E=REDIRECT:FALSE]

  RewriteCond %{HTTP_HOST} ^dashboard-alias.foobar.com$
  RewriteRule (.*) $1 [E=REDIRECT:FALSE]

  RewriteCond %{ENV:REDIRECT} TRUE
  RewriteRule ^/(.*) http://dashboard-alias.foobar.com/$1 [NC,R,L]

</VirtualHost>

When I read this documentation: https://httpd.apache.org/docs/2.2/howto/public_html.html I understand it to be exactly what this is, but I'm obviously misunderstanding. If it's not UserDir, then what is the name of this feature? — Justin Killen, Mar 13 '18 at 18:47
A userdir URL has the form `~username/file`. That is different from your example `~/nobody/test` (note the `/` after the `~`). — Sven, Mar 13 '18 at 18:55
my mistake, I typo'd when I put it in the question - it's been updated — Justin Killen, Mar 13 '18 at 19:04
Do you have any configuration options in your apache configs that reference "Directory "/home/*/public_html" ? It might be helpful to post your apache configs up here. Perhaps post the output of the following for easy reading: find -name \*.conf -print -exec egrep -v -e '^(.*#|$)' {} \; — Eirik Toft, Mar 13 '18 at 20:33
Have you tried keeping the mod and disabling it using `UserDir disabled`? — Ondřej Xicht Světlík, Mar 13 '18 at 22:00
The only thing I have in my config related to mod_userdir is: UserDir disabled Even if i remove the LoadModule for mod_userdir, I still get this behavior — Justin Killen, Mar 13 '18 at 22:28

score 0 · Accepted Answer · answered Mar 14 '18 at 18:57

0

Turns out this was due to a bad rewrite rules:

RewriteRule (.*) $1

I changed them to:

RewriteRule - -

Thanks all for the pushes in the right direction

answered Mar 14 '18 at 18:57

Justin Killen

121
5

Disable UserDir functtionaility - apache httpd 2.2.29 mod_userdir disabled, but ~ queries still being served

1 Answers1