How can I disable specific file type uploads globally in Apache?

Question

In order to secure my webserver, I would like to block specific file types from being uploaded globally, independent of what FTP users configure in their webpages.

Is there a way to globally block specific file types from being uploaded (such as PHP files) in Apache?

Solution

I am unaware of anything that would stop uploads (if using sftp or something else), from Apache, though if using PHP for the uploads, then the file extensions can be disabled.

Likely there would be some setting in whatever SSH/FTP server one is using.

However, from Apache there are various ways of disabling execution of files from given directories, using things like FilesMatch / deny from all, or SetHandler / None. These could be in .htaccess files or in httpd.conf.

See https://stackoverflow.com/questions/5689423/how-to-ban-all-executable-files-on-apache for a similar discussion.

Comments

[dawud]

What do you want to prevent? execution of those files? is it an option to mount the target filesystem noexec?

[Michiel Pater]

I would like to prevent visitors from uploading PHP (and other) files through PHP file upload.

[dawud]

Again, PHP is plain text, what do you want to prevent? what would be allowed?

[Michiel Pater]

PHP can access the mailserver and use it for spamming.

[NuTTyX]

Are you serving PHP on your Apache? If not, disable that module and also similars like cgi. If you do serve PHP, just do not allow your users to upload files to the DocumentRoot of your Apache. If you serve PHP and your users need to upload files to the DocumentRoot of your Apache... well, I'd go to force a text/plain response on the Apache for your users files.