Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What are some best practices, recommendations, required reading for securing an Apache Server?

share|improve this question
    
Install nginx!? –  F. Hauri Jul 8 '13 at 8:12
add comment

14 Answers

Grab the Center for Internet Security (CIS) guide for securing Apache (it describes in detail how to enhance the security):

Edit: Updated link CIS Apache HTTP Server 2.2.x Benchmark

If you have a license to Nessus, then you can run an automated check by grabbing their audit template:

alt text

share|improve this answer
add comment

You might also wanna check the Secure Configuration of the Apache Web Server, Apache Server Version 1.3.3 on Red Hat Linux 5.1 . It's a guide from NSA

share|improve this answer
    
"Secure your apache so we can't steal stuff" article hey? ;P –  DarkMantis Oct 1 '13 at 8:24
add comment
  • Use SSH key based logins
  • Secure MySQL
  • Disable phpMyAdmin, webmin, etc
  • Close all ports/process's that are not needed
  • Use a file integrity checker
  • Use mod_security
  • Set the proper permissions/groups

This is a good guide:
http://serverfault.com/questions/212269/tips-for-securing-a-lamp-server

Basic guide for hardening http://www.wpsecure.net/server-guide/

Also if your running php http://www.madirish.net/?article=229

Also

Find 404's ( or other status codes) in apache log
awk '$9 == 404 {print $7}' access_log | uniq -c | sort -rn | head

share|improve this answer
add comment

There's lots of good advice here, so I won't repeat things already mentioned. But what I will say is:

Don't forget to replace the default error pages with things that don't give away your Web Server release or kernel revision. I tend to replace each default html with 1 liners that are something like "Error 400." It gives very little about the system away. This principal applies to all web servers capable of displaying custom error pages, they all pretty much default to giving away far too much information than is necessary. You would think that ServerSignature would hide this, but in many cases it does not.

Also, don't forget to delete all the default HTML content (language specific etc.) so fingerprinting is that much harder.

As far as good reads go there was a whitepaper from Apcon 2008 that's worth a read.

Mod_Security is mentioned a few times, this is more suited to web applications, so if you are serving static content only, it's not going to help you too much, though there are some attacks it helps defend against during request handling which could affect a static Web Server.

The other thing I'd mention is good log management, if you aren't farming your logs off and keeping a close eye on the system you run the risk of an attacker pounding away at it without having any awareness of it.

share|improve this answer
add comment

All the general security principles apply: run only modules you need, turn off features that you don't need, tidy up your permissions/ownerships (most contents are read only, so why do the files need anything more than 400 perms?).

The stuff that's particular to Apache, like CGI jobs, or different vhosts serving out the same content twice with two different security mechanisms on them are much harder to spot; not exactly an automated check, you actually gotta know Apache, the underlying OS, and what the applications running in Apache are doing.

For completeness sake here's a Apache Security Checklist from DISA

share|improve this answer
add comment

The originally highly voted answer to this question that was accepted was deleted because it was a direct plagiarism of 20 ways to secure your Apache configuration. That page is a fantastic resource.

@RoryMcCune also posted this as a link on that answer: There's an OWASP project to develop a ModSecurity Core Rule Set here which could be of use.

share|improve this answer
add comment

I was just looking for the same thing a few days ago, and found this article to be among the best ones I found. Pretty much covers all that's important. Use it together with official apache documentation.

share|improve this answer
add comment

It might be worth giving Apache mod_security a look.

I have been giving it a go on some of my servers lately not only does it perform some configuration tweaks to Apache itself like changing version number etc but it also acts as a web application firewall helping to protect against a wide variety of attacks such as SQL injection etc.

share|improve this answer
add comment

Free PDF of chapter 2 of Securing Apache

share|improve this answer
add comment

How Do I Secure Apache Web Server

What answer would you expect if you asked "How do I fly a jumb-jet" or "How do I do brain surgery" - the same applies to making a webserver secure - you need to do 1000's of hours of training, practice and research. But since everyone has to start somewhere...

There are lots of basic checklists on the internet for how to harden a server - but as per my comment elsewhere they vary greatly in quality.

I'd recommend the sans one as a good source.

Once you've followed the checklist you need to establish means by which you can

  • verify the integrity of your server (you definitely need a host based IDS such as tripwire along with a rootkit detector)
  • be aware of and apply patches
  • recover your system to a known good state

Don't plan for how you deal with a security incident if it happens. Plan for what to do when it happens.

After you've got your system setup and configured then swap out the hard disk and see how long it takes you to get the service up and running again without using the original disk.

share|improve this answer
    
thanks alot i will loot at it ... –  One Zero Jan 13 '12 at 14:18
add comment

http://www.unixmen.com/10-ways-to-secure-your-apache-installation/

and

Linuxforu has an amazing 10 chapter guide dedicated to securing apache only its a really good read: http://www.linuxforu.com/category/how-tos/secure/

share|improve this answer
    
thankYou... very helpful @balgan –  One Zero Jan 11 '12 at 14:56
3  
I also like the NSA hardening guides. Chapter 3.16 in the RHEL guide is on hardening the web server. –  logicalscope Jan 11 '12 at 14:59
1  
One of the secrets to researching things is to know the terminology - as logicalscope points out, this process is called "hardening". Google Apache 2.0 Hardening and you'll find a lot of stuff. –  Graham Hill Jan 11 '12 at 15:42
    
okay i will ...ty –  One Zero Jan 11 '12 at 17:26
    
From the first link..."chown –R apache /var/www/html" to improve security????!!!! Pope was right: A little learning is a dangerous thing, drink deep or sup not of the pierian well. There's no magic recipe and no substitute for knowing what things like permissions and ownership mean and having an understanding of the topic. That is a prerequisite before planning a security model, which is a pre-requisite to implementing a security model - you can't skip straight to the last step. –  symcbean Jan 13 '12 at 13:42
add comment

this is not just apache-related (and also counts for nginx+php-fpm), but often forgotten: php-eastereggs, that might be switched of via php.ini

  expose_php = off

it is not as terrible as leaving a phpinfo.php behind, but usually is a hint to very lazy system-administration.

see easter-eggs

share|improve this answer
add comment

Use the latest version of apache, patch your OS and also of the third parties like openssl or any other.

Block unwanted ports.

This will protect you from some known vulnerabilities, but you will always be susceptible to a 0-day, of course.

share|improve this answer
add comment

Good thread turned. Many people say truth.

They forgot one, OpenBSD's way:

In OpenBSD, the Apache httpd(8) server has been chroot(2)ed by default

httpd (v.1 of Apache) included in OpenBSD by default, and chrooted by default.

You can repeat it easy with apache2 or nginx on any other Unix-like OS.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.