DirectAdmin 1.40.1 security release

Please update to 1.40.1:

Hello,

 

DirectAdmin 1.40.1 has been released.

http://www.directadmin.com/versions.php?version=1.401000

 

It’s mainly a bugfix release to address the broken commands.deny/allow feature.

 

There is a new feature for tracking realtime email usage (requires exim.pl update):

http://www.directadmin.com/features.php?id=1277

 

—————–

SECURITY:

 

There is also an important custombuild change, logged into this version:

http://www.directadmin.com/features.php?id=1119

 

with regards to security and the FollowSymLinks option.

Existing boxes will not have their AllowOverride options changed from “All”, but we dont’ recomend using that value anymore.

The reason for not changing existing boxes is that many scripts use the FollowSymLinks in .htaccess files, and applying this change will trigger an “internal server error” for their website, hence we leave it to you to decide.

If you’d like to implement it (recommended), run the following:

 

cd /usr/local/directadmin/custombuild

./build update

./build set secure_htaccess yes

./build rewrite_confs

 

but you may need to manually change .htaccess files to remove the option..

Or add “AllowOverride All” to:

Admin Level -> custom httpd config -> domain.com

 

for that domain.

 

Note that new installs do have this option enabled by default. Existing installs do not.

 

Forum thread:

http://www.directadmin.com/forum/showthread.php?t=42332

 

 

—————–

 

For anyone who didn’t get the notice about the release of 1.40.0:

http://www.directadmin.com/versions.php?version=1.400000

http://www.directadmin.com/forum/showthread.php?t=42194
Thank you,

John
—————————————————–
DirectAdmin Web Control Panel
http://www.directadmin.com

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>