Questions about the security of Apache open source software, especially Apache HTTP Server
2
votes
2answers
366 views
Allow apache to write to users' .ssh dir's
I know the title is just baiting the "your setup is insecure", but allow me to explain.
I'm working on an application which aims to allow clients to rsync over SSH to our server. We need a web ...
2
votes
2answers
424 views
Writing files in a sub folder of the web folder (apache security)
I need to save session data for a dynamic web page script by writing to file. I have two questions:
Are there any security preferences as to whether to save the data UNDER the web folder, or OUTSIDE ...
0
votes
1answer
333 views
Mod_security rules-updater.pl fails to pull new release
Mod_security has a rules updater distributed with their release packages on sourceforge:
http://sourceforge.net/projects/mod-security/files/modsecurity-crs/0-CURRENT/
Usually, you can run the script ...
2
votes
1answer
290 views
What attacks use enabled Apache's PATH_INFO?
In Tangled Web Michal Zalewski says:
If you are not using path-based parameter passing (such as PATH_INFO), consider disabling this feature.
He gave only one example of this vulnerability. There ...
7
votes
4answers
2k views
Protecting against DOS attacks
Our current site is easily DOS'd. I can perform an AB test against it from Apache and it disappears for about 5-10 minutes. We have been having problems with others DOSing the site - to the point ...
1
vote
2answers
720 views
How do I figure out how malware infected my server, and the subsequent sites on the server?
I recently was in charge of fixing our server at work, and cleaning the sites on it. We were infected with some malware that injected some code into some of our clients websites. Apparently, there was ...
4
votes
1answer
420 views
Does installing Apache on my local machine create new security risks?
I am developing a small LAMP online app, and so far I have been doing all the development online.
I am considering installing Apache/PHP/MySQL on my Ubuntu machine to be able to develop locally as ...
4
votes
2answers
921 views
How to get site's 'real' URL (before being rewritten)
If a site uses .htaccess file to rewrite the URL for e.g. better SEO. Is it possible to find out what is the "real" URL?
1
vote
2answers
2k views
Find the hack in the Apache2 logs?
The hack was a failure, as they were not able to put the created page as the home page. But we found recently a manipulated page on our website (via the rss).
So I looked in the Apache2 logs and ...
1
vote
0answers
184 views
How Do I Secure Apache Web Server [duplicate]
Possible Duplicate:
Apache Server Hardening
I'm going to make a web server on Apache 2.
What are the security issue I will be looking at? And how do I secure it?
I have been reading news ...
2
votes
1answer
177 views
Does this htaccess snippet provide sufficient security?
I've downloaded a part of .htaccess to prevent from using base64_encode or <script> or _REQUEST within URL. Is this secure enough to help me out for partial security, or is it just a waste of ...
3
votes
1answer
409 views
Blacklist IP addresses based on number of 404s in Apache
I'm getting a lot of hackers spamming my domain with requests for files that just don't exist. This is eating up a lot of my allotted bandwidth and I'd like to blacklist these IP addresses.
Is there ...
10
votes
2answers
901 views
Security implications of having files owned by the apache user?
Currently running a LAMP instance that developers are using for a variety of webapps. I have the following scenario:
Multiple developers need access to create and modify files under ...
2
votes
3answers
664 views
HTTPS Apache2 Information Leakage
Hello IT Security!
I have Apache2 vhost with HTTPS listening on port 443, ie. https:// securesecret.com.
I have another vhosts with HTTP listening on port 80, ie. http:// one.com, http:// two.com.
...
4
votes
4answers
731 views
Server wide javascript injection
UPDATE: The server was rooted, php.ini was replaced that cause the injection to appear. Still haven't figured out which directive is injecting the javascript.
I'm troubleshooting a hacked website ...
5
votes
1answer
552 views
What on earth is this log entry in Apache?
error.log - Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8g mod_fastcgi/2.4.6 mod_fcgid/2.3.4
[Mon Oct 10 22:35:18 2011] [error] [client 91.212.226.95] (36)File name too long: access to ...
6
votes
1answer
2k views
How to secure a ActiveMQ?
Does anybody have experience with securing/hardening ActiveMQ?
Check lists or guides would be welcome.
4
votes
4answers
297 views
How to secure test/dev environments from outside world?
I would like to set up a security barrier to my test/dev environments. I'm under a more or less typical LAMP on dedicated servers.
Thing is, I have some facebook apps, a widget for other devices, and ...
6
votes
2answers
2k views
Implications of Trace/Track Methods on Apache
When performing vulnerability scans using Nessus, against a host running Apache, one expected result is always "HTTP TRACE / TRACK Methods Allowed". While this result only has a base CVSS of 4.3, I ...
8
votes
4answers
3k views
How safe is it to install XAMPP on my home computer to test PHP code?
I want to test some PHP code and I figure the best way is to install XAMPP - but I'm nervous about installing server software on my home computer.
Is it generally safe to install XAMPP (given that I ...
8
votes
4answers
764 views
Combat Apache Killer
Three days ago, KingCope released a simple Perl script to DoS Apache, aptly named Apache Killer.
This script launches about 50 threads to request Partial Content from the server with optional GZIP ...
9
votes
4answers
781 views
Can .htaccess and .htpasswd really protect me?
I want to set up a kind of personal wiki where I can store various sensitive information. However to make it 100% portable and and just plain convineant, I want to put it on the Internet. I'm sure at ...
7
votes
2answers
1k views
Securing my web-server / website [closed]
Does anyone know of a comprehensive security guide about important basics / fundamentals which should be done to secure a web-server / website? A web link would do.
6
votes
3answers
385 views
Is displaying what server I am running on the error pages a security risk?
I just noticed that my 403 Forbidden (the default, not a custom one) page displays some server info:
Apache/2.2.3 (Red Hat) Server at ... Port 80
Is revealing this information a security risk?
2
votes
1answer
459 views
Mod Security for apache2 blocks curl!
I'm trying to get my users lat and lng from their address using google's geocoding api but when mod security is enabled it prevents it and the script timesout. How can I add an exception by ip or ...
7
votes
5answers
999 views
Master thesis topic - mod_security
I've been playing with mod_security for some time and I'd like somehow to use it in my master thesis. I don't know exactly how this work could be more interesting than describing what mod_security ...
18
votes
7answers
4k views
Can I detect web app attacks by viewing my Apache log file?
I occasionally get clients requesting I look at their access_log file to determine if any web attacks were successful. What tools are helpful to discern attacks?
58
votes
12answers
10k views
Apache Server Hardening
What are some best practices, recommendations, required reading for securing an Apache Server?
