Setting up a web server with Apache on a Linux distribution is a very quick process, however to make it a secure setup takes some work. This article will show you how to make your Apache web server more secure from an attack by effectively using Access control and authentication strategies.
 Bill Keys |
File Permissions and Access Control
Users and groups:
One of the first things to ensure is that Apache does not run as root because if Apache is cracked then an attacker could get control of the root account. Lets take a look at what user and group Apache is running as.
Run the following command:
# ps auwwfx | grep apache www-data 25675 0.0 0.0 10348 508 ? S Jan21 0:00 \_ /usr/sbin/apache2 -k startAs you can see www-data is the user running Apache. However if it's not then you need to edit your Apache configurations and create a new user and group by:
www-data 25686 0.0 0.2 231816 2208 ? Sl Jan21 0:00 \_ /usr/sbin/apache2 -k start
www-data 25688 0.0 0.2 231816 2200 ? Sl Jan21 0:00 \_ /usr/sbin/apache2 -k start
# groupadd www-dataChange:
# useradd -g www-data www-data
# vi /etc/apache2/apache2.conf
User rootTo:
Group root
User www-dataDo a reload to make sure the changes take effect:
Group www-data
# /etc/init.d/apache2 reloadPermissions to serve files:
One of the most overlooked security practices is correctly using the chmod command. For example, we just created a index.cgi in our Apache html root directory but when we go to open the file in our browser we get the error message permission denied. To get our index.cgi file working we do a chmod 777 index.cgi. Before you try this, every Apache administrator should think to themselves' is this secure? The answer should be NO! But how do we make the permissions secure enough and allow the index.cgi script to work?
chmod:Apache needs to have permission to execute the index.cgi file. However, we don't want everyone to read and write to index.cgi. The owner of the file should have permission to read and write to the file. We do this by:
# chmod 755 index.cgiFiles outside the web root should not be served:
It's very important to have the following lines in your apache.conf:
Notes
Options FollowSymLinks
AllowOverride None
1.The above lines prevent Apache from having access to files outside of its web root.
2.Some distributions have better default security configuration then others. EnGarde Secure Linux is one example where they include the above lines in their Apache configuration file by default.
We don't want users running CGI scripts anywhere on the filesystem but we do need them to run in the web root. The solution to this problem is the "Options ExecCGI" directive.
Example:
Add the following lines to /etc/apache2/apache2.conf:
Reload apache:
AllowOverride None
Options ExecCGI
Order allow,deny
Allow from all
# /etc/init.d/apache2 reloadWhat if your have resources that should only be accessed by a certain network or IP address?
A solution to this problem is using our Apache configuration to enforce it for you.
Example only allow access to network 192.168.0.0.
Change the following lines in your /etc/apache2/apache2.conf:
To:
AllowOverride None
Options ExecCGI
Order allow,deny
Allow from all
Do a reload to make sure the changes take effect:
AllowOverride None
Options ExecCGI
Order Deny,Allow
Deny from all
Allow from 192.168.0.0/16
# /etc/init.d/apache2 reloadNow only users on you internal network can run CGI script in "/home/username/public_html/cgi-bin"
Authentication
How can we allow only users with the correct password and username to have access to a part of our web root? The following steps will show you how to do this securely.
Basic authentication:
Enable .htaccess
# vi /etc/apache2/apache2.confChange:
AllowOverride NoneTo:
AllowOverride AuthConfigDo a reload to make sure the changes take effect:
# sudo /etc/init.d/apache2 reloadCreate a password file:
# mkdir /var/www/miscCreate .htaccess
# chmod a+rx /var/www/misc
# cd /var/www/misc
# htpasswd -bc private.passwords username password
Adding password for user username
# cd /home/username/public_html/cgi-binAdd the below in .htaccess
# vi .htaccess
AuthName My Private Area"Change:
AuthType Basic
AuthUserFile /var/www/misc/private.passwords
AuthGroupFile /dev/null require valid-user
To:
AllowOverride None
Options ExecCGI
Order Deny,Allow
Deny from all
Allow from 192.168.0.0/16
Do a reload to make sure the changes take effect:
AllowOverride .htaccess
Options ExecCGI
Order Deny,Allow
Deny from all
Allow from 192.168.0.0/16
# /etc/init.d/apache2 reloadDigest authentication:
Another method for authentication is called digest authentication. With digest authentication your password is never sent across the network in the clear because they are always transmitted as an MD5 digest of the user's password. This way passwords cannot be determined by sniffing network traffic:Create a password file:
# mkdir /var/www/miscCreate .htaccess
# chmod a+rx /var/www/misc
# cd /var/www/misc
# htdigest -c private.passwords realm username
Adding password for username in realm realm.
New password:
# cd /home/username/public_html/cgi-binAdd the below in .htaccess
# vi .htaccess
AuthName "My Private Area"Notes
AuthType Digest
AuthUserFile /var/www/misc/private.passwords
AuthGroupFile /dev/null require valid-user
1.For more information on htdigest please check the man pages.
2.Some older versions of Web browsers don't support Digest authentication.
3.To fully protect your .htaccess use SSL.
Where to go from here?
The next step in a more secure Apache is to use some of the Apache modules decided for helping Apache security even more. Some examples are mod_security and mod_chroot. Also, to protect our authentication we will need to configure SSL. In a upcoming HOWTO it will show you how to use SSL to further increase your web server's security and other advance techniques. What ways would you suggest to best secure a Apache web server?
References:
Security Tips for Server Configuration:
Apche.org - Security Tips
Security and Apache: An Essential Primer:
Linuxplanet/- Apache Tutorial
Apache Homepage:
http://www.apache.org
|
|
| Comments | |
| Written by S.MacLeod on 2008-01-30 13:21:32 |
Install the latest security patches
httpd.conf:
ServerSignature Off
ServerTokens Prod
Disable any unnecessary modules
Make sure only root has read access to apache's config and binaries
Lower the Timeout value
Limiting large requests
Limiting Concurrency
Adjusting KeepAlive settings
suEXEC
http://httpd.apache.org/docs/2.0/suexec.html
CGIWrap
http://cgiwrap.sourceforge.net/
Acknowledgments:
These ideas are sourced from the folloing two pages;
Pete Freitag - 20 ways to Secure your Apache Configuration
http://www.petefreitag.com/item/505.cfm
Apache > Miscellaneous Documentation > Security Tips
http://httpd.apache.org/docs/2.0/misc/security_tips.html
| Nice how-to | Written by jon on 2008-01-29 20:29:24 |
| what am i missing | Written by chris on 2008-03-17 13:22:48 |
it responded with:
Invalid command 'AllowOveride', perhaps misspelled or defined by a module not included in the server configuration
...fail!
| THIS IS WHY ADDING STUFF TO APACHE2.conf | Written by DJ on 2008-04-07 13:01:17 |
the file for me is located in /etc/apache2/sites-available/default
use your favorite text editor to edit the "default" file.
-DJ
| AllowOverride | Written by jon on 2008-04-07 13:29:41 |
Looks like you missed spelled AllowOveride which should be AllowOverride.
Invalid command 'AllowOveride',