How to disable HTTP Trace - V5R3

[gcraill]

Gotta be a downer as a Broncos fan this week ...

But anyways for the rest of us that aren't crying over that, does anyone know how to disble the Trace method in HTTP?

Some auditors want us to can it ... lots of hits on Google but links not proving too useful today, I'd even be happy to see lmgtfy coming at me if it helped ...

Greg

[jamief]

Re: How to disable HTTP Trace - V5R3

doesnt this work?

http://www.vmadmin.co.uk/linux/44-redhat/218-linuxhttptracktracehttp://www.vmadmin.co.uk/linux/44-redhat/218-linuxhttptracktrace

To turn off track and trace methods globally on the server add the following line:
vim /etc/httpd/conf/httpd.conf
TraceEnabled Off

To turn off track and trace methods for individual virtual hosts add the follwowing to the vhost config:
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]


Check the apache config:
/usr/sbin/apachectl -t
Syntax OK


Restart apache:
/etc/init.d/httpd restart
Stopping httpd: [ OK ]
Starting httpd: [ OK ]

[gcraill]

Re: How to disable HTTP Trace - V5R3

doesnt this work?

http://www.vmadmin.co.uk/linux/44-redhat/218-linuxhttptracktracehttp://www.vmadmin.co.uk/linux/44-redhat/218-linuxhttptracktrace

Not really ... this ain't linux here bub ...

doesnt this work?
To turn off track and trace methods globally on the server add the following line:
vim /etc/httpd/conf/httpd.conf
TraceEnabled Off

As far as I see it TraceEnable was added in V5R4 and we are on V5R3, it throws a directive syntax error.
Also /etc/httpd*does not exist.

doesnt this work?
To turn off track and trace methods for individual virtual hosts add the follwowing to the vhost config:
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]

• RewriteEngine On - is OK.
• RewriteCond %{REQUEST_METHOD} ^TRACE - is OK.
• RewriteRule .* - [F] - throws a directive syntax error. (I think this is the CRUX!)

doesnt this work?
Check the apache config:
/usr/sbin/apachectl -t
Syntax OK

Alas /usr/sbin/apache*does not exist.

doesnt this work?
Restart apache:
/etc/init.d/httpd restart
Stopping httpd: [ OK ]
Starting httpd: [ OK ]

Alas /etc/init*does not exist.

[gcraill]

Re: How to disable HTTP Trace - V5R3

Alternatively, note that Apache versions 1.3.34, 2.0.55, and 2.2 support disabling the TRACE method natively via the 'TraceEnable' directive.

Hmmm - we are on Apache version 2.0.58, but it doesn't work?