云博 - 备份 Contempo Theme: Apache

Showing posts with label Apache. Show all posts

Sunday, January 29, 2012

10 Apache Security and Hardening Tips

http://www.kyplex.com/docs/apache-security.html

| Kyplex cloud security

The Apache web server is a crucial part of the website infrastructure. It has a number of built in features that can improve your website resistance to attacks. The following document covers a number of steps that will help you to achieve this goal. This document is largely based on the knowledge gathered by our security team and by statistics information revealed by our security scanner.

Tip No. 1: Disable Apache Signature and/or Apache Banner

Apache Signature or Apache Banner is basically the same thing. It is an application name together with version name that is printed when performing a web request. Nobody actually needs this information at all, but it is enabled by default. You need to alter the Apache configuration file to disable it.

In Ubuntu, you need to change the following file: /etc/apache2/apache2.conf

Double check that ServerSignature and ServerTokens configuration settings are not enabled in some other parts of the configuration file.

Tip No. 2: The Trace HTTP Request

HTTP TRACE request is used to echo back all received information. It can be tricked to print HTTP cookies and as a result steal HTTP session. Basically this request can be used as part of the Cross Site Scripting attack, or XSS. It is recommended to disable it as a security precaution.

Add the following to the web-server's configuration file. For example alter the following file in Ubuntu: /etc/apache2/apache2.conf .

Tip 3: Remove PHP scripts that print debug info using phpinfo()

The built-in PHP function phpinfo() prints a lot of interesting internal information about the PHP environment. It can include list of which PHP modules are enabled, and the location of various files on the web-server and other sensitive information. Our web security scanner finds a lot of such files. It is recommended to remove these test files from a production website.

Here is a tip hpw to find such files. Look for the files with the following name: test.php,info.php, i.php and phpinfo.php in your website directory and remove them.

Tip 4: Disable directory indexing

Directory indexing is a features found in every web-server by default. When directory indexing is enabled, the web-site prints a list of files found in the website directories when the default page does not exists (for example index.php). Directories reported can be viewed by any visitor. It is vulnerable in the sense that these directories can contain configuration, private and backup files which can be used by the attackers to take your server under control.

You can fix this problem by disabling the Apache autoindex module. In some Apache installations it is called mod_autoindex.so. In Ubuntu, you just need to remove the following files:

So you can do it running the following commands:

Tip 5: Disable WebDAV

WebDAV is a file access protocol created over HTTP protocol. It allows you to upload and download files, and change file contents from the website. This service is required only in very rare cases. From our experience, this feature was only required to run SVN server (link). Make sure that WebDAV is disabled in production websites. When WebDAV is enabled, the following commands are supported by Apache: OPTIONS, PROPFIND, etc. These commands are sensitive from computer security point of view.

You can fix this problem by disabling Apache dav, dav_fs and dav_lock modules. In Ubuntu you just need to remove the following files:

So you can do it running the following commands:

Tip 6: Create a chroot'ed Apache environment

Chroot is a kind of virtual environment supported operating systems such as Linux and FreeBSD. When an application is executed in chrooted environment it has no access to the parent disk and to other recources.

This is a good solution if you want to protect your website from malicious users. The action steps required to create chroot Apache was already covered in a number of websites. For example: http://www.linux.com/archive/feed/36331

The main hidden issue with chrooted environment is that this environment protects the websites from accessing the operating system's files. It does not protect one site from another. In other words, if a malicious script located in one site it can access files located on other site because they are located on the same chrooted environment.

A solution to this problem is the following. Create a number of apache instances, each one hosting one website running each one if different chrooted directory. These apache instances will not be able to share IP addresses. You will have to configure different IP for each Apache instance you run.

Tip 7: Enable PHP basedir

PHP has built in a kind of chroot environment. It is called "basedir". You can configure PHP scripts to access files only in specific directory similar to chroot. Basically you can configure each site to access only files located in that site directory which is a very good idea from the security point of view.

You can add the following lines to the website configuration file or to .htaccess file to enable PHP basedir:

This will specify that your PHP scripts can access only specified directories.

Tip 8: Web Stats

Some webmasters install open source tools on their website that analyze web requests and create statistical reports. Access to these webstat scrips is almost never secured with a password. So any visitor can basically view such reports. For example some webmasters install in in the /stats directory accessible by http://www.my-site.com/stats .

Statistical reports contain a lot of sensitive information. For example it can contain hidden file names and directory names, full web requests, search engine keywords, etc... All this information can be used by the malicious users and/or your competitors.

Instead of running a statistics script on your website we recommend that you use Google Analytics. It is a free-of-charge and quality service.

Tip 9: Use Google

Most of the webmasters use common web scripts and CMS or blog software. We recommend you to frequently search for security updates using Google and register for security news at your blog/CMS website.

Tip 10: Additional Steps

If your webserver runs together with MySQL server it brings additional potential security problem. MySQL can read any files located on you server including the one located in different chrooted environments. It happens because of the FILE permission. By default only MySQL root has it. For more info about MySQL security take a look at this article ( link to GreenSQL) .

Install a Database Firewall

Download GreenSQL Express which is a free version of the GreenSQL database firewall.

Install a Web Firewall

Mod_security is a good open source product.

Additional links

Friday, November 5, 2010

Google Soups Up Apache With New Speed Module

http://www.linuxinsider.com/alert/71177.html?wlc=1288976235

By Richard Adhikari
LinuxInsider
11/05/10 5:00 AM PT

Apache HTTP Server users can make use of Google's latest tool, mod_pagespeed, to automatically optimize their websites' speed. The module automates optimizations that are usually somewhat troublesome to do manually, like making changes to pages built by CMS, recompressing images when its HTML context changes, and extending cache lifetime.

Google (Nasdaq: GOOG) on Wednesday released mod_pagespeed, a module for the Apache HTTP Server that will automatically perform various website speed optimization tasks.

This includes 15 or so on-the-fly optimizations.

Google claims mod_pagespeed reduces average page load times by up to 50 percent.

However, mod_pagespeed works only on Apache servers and is complex to deploy, according to Omri Iluz, strategic partnerships manager at Cotendo, which provides site acceleration services to website owners.

The Mod Squad

Google has released the mod_pagespeed module as open source for Apache for many Linux distributions. The module automates optimizations that are troublesome to do manually.

These optimizations include making changes to the pages built by content management systems (CMS); recompressing an image when its HTML context changes so only the bytes required are served; and extending the cache lifetime of the logos and images of users' websites to a year.

The mod-pagespeed module changes CMS pages without having to make changes to the CMS itself. While it extends the cache lifetime of a website's logos and images, users can update these at any time. The module is an addition to Google's Page Speed tool, which gives website developers suggestions on how to speed up Web pages.

"In recent years, as the browser market has evolved and new browsers have emerged, website creators and developers haven't kept up to speed in modifying their sites to work well with the new browsers," Cotendo's Iluz told LinuxInsider.

"YSlow and Page Speed check your website and come up with a list of actions you need to apply to your website to improve its performance," Iluz added. "The technology Google released Wednesday is a layer on top of your code that, in addition to telling you what's wrong with your website, fixes the problem."

YSlow is a tool from Yahoo (Nasdaq: YHOO) that checks websites to see where they can be optimized.

Google did not respond to requests for comment by press time.

Nothing's Easy

The mod-pagespeed module will make life easier for website owners because they won't need to perform advanced configuration tasks on their Web servers, Ronni Zehavi, CEO of Cotendo, told LinuxInsider.

However, it's complex and works only on Apache servers, Cotendo's Iluz pointed out.

Cotendo worked with Google to enhance the module to handle massively scaled content delivery environments and deployment to multiple customers and in various configurations as a service.

"Your traffic goes through our global network, our service applies optimization in the cloud and we send the traffic back to you," Iluz said. "You as the website owner don't have to do anything."

Cotendo on Wednesday announced the deployment of Page Speed Automatic, a new website code optimization service that uses the mod_pagespeed optimization engine.

This service automatically optimizes the code of HTML pages as they enter a content delivery network. It will optimize caching, reduce the number of data requests, and reduce the payload size of pages, among other features. These code modifications, when rendered within Cotendo's network, can reduce image size by 20 percent to 30 percent and page load time by as much as 50 percent on top of the acceleration already achieved by Cotendo's existing site acceleration services, including its Dynamic Site Acceleration Service, the company claims.

Go Daddy, Go, Jack up the Speed

Website host Go Daddy plans to implement mod_pagespeed for its 8.5 million customers.

"We know through interaction with our customers that high performance is a top priority," Brian Krouse, senior director for platform R&D at Go Daddy, told LinuxInsider.

"A faster, snappier website is better for a customer's online presence," Krouse added. "That's why Go Daddy is keenly interested in doing whatever we can to make it as easy as possible for customers to build high-performance websites."

Go Daddy will offer mod_pagespeed through its Linux Shared Hosting platform to its customers worldwide.

However, the website hosting company has not yet fixed a date when the service will be rolled out, Krouse said.

Friday, August 13, 2010

Install PHP cURL on Ubuntu 10.04

http://www.blog.highub.com/php/php-core/linux-ubuntu-install-setup-php-curl/

If you use PHP, you may need to use cURL, which is one of the most popular extension. PHP CURL functions are available through the use of libcurl, a library created by Daniel Stenberg, and allow you to connect and communicate with web servers using many
different types of protocols.

Assume you have already setup LAMP. To install or setup cURL on your Linux machine like Ubuntu, run the following line of shell command in your terminal:

sudo apt-get install curl libcurl3 php5-curl

Now you have PHP cURL installed, the next thing you need to do is to restart apache2, run the following command in your terminal:

sudo /etc/init.d/apache2 restart

Monday, August 9, 2010

Very basics of regexp for mod_rewrite

Regex vocabulary
The following are the minimal building blocks you will need, in order to write regular expressions and RewriteRules. They certainly do not represent a complete regular expression vocabulary, but they are a good place to start, and should help you read basic regular expressions, as well as write your own.

Character	Meaning	Example
.	Matches any single character	c.t will match cat, cot, cut, etc.
+	Repeats the previous match one or more times	a+ matches a, aa, aaa, etc
*	Repeats the previous match zero or more times.	a* matches all the same things a+ matches, but will also match an empty string.
?	Makes the match optional.	colou?r will match color and colour.
^	Called an anchor, matches the beginning of the string	^a matches a string that begins with a
$	The other anchor, this matches the end of the string.	a$ matches a string that ends with a.
( )	Groups several characters into a single unit, and captures a match for use in a backreference.	(ab)+ matches ababab - that is, the +applies to the group. For more on backreferences see below.
[ ]	A character class - matches one of the characters	c[uoa]t matches cut, cot or cat.
[^ ]	Negative character class - matches any character not specified	c[^/]t matches cat or c=t but not c/t

In mod_rewrite the ! character can be used before a regular expression to negate it. This is, a string will be considered to have matched only if it does not match the rest of the expression.

Here's the very basics of regexp (expanded from the Apache mod_rewrite documentation)..

Escaping:
\char escape that particular char
For instance to specify special characters.. [].()\ etc.

Text:
. Any single character (on its own = the entire URI)
[chars] Character class: One of following chars
[^chars] Character class: None of following chars
text1|text2 Alternative: text1 or text2 (i.e. "or")
e.g. [^/] matches any character except /
(foo|bar)\.html matches foo.html and bar.html

Quantifiers:
? 0 or 1 of the preceding text
* 0 or N of the preceding text (hungry)
+ 1 or N of the preceding text
e.g. (.+)\.html? matches foo.htm and foo.html
(foo)?bar\.html matches bar.html and foobar.html

Grouping:
(text) Grouping of text
Either to set the borders of an alternative or for making backreferences where the nthe group can
be used on the target of a RewriteRule with $n
e.g. ^(.*)\.html foo.php?bar=$1

Anchors:
^ Start of line anchor
$ End of line anchor
An anchor explicitly states that the character right next to it MUST
be either the very first character ("^"), or the very last character ("$") of the URI string to match against the pattern, e.g.. ^foo(.*) matches foo and foobar but not eggfoo
(.*)l$ matches fool and cool, but not foo