Questions about the security of Apache open source software, especially Apache HTTP Server

learn more… | top users | synonyms

10
votes
5answers
7k views

How safe is it to install XAMPP on my home computer to test PHP code?

I want to test some PHP code and I figure the best way is to install XAMPP - but I'm nervous about installing server software on my home computer. Is it generally safe to install XAMPP (given that I ...
9
votes
4answers
856 views

Combat Apache Killer

Three days ago, KingCope released a simple Perl script to DoS Apache, aptly named Apache Killer. This script launches about 50 threads to request Partial Content from the server with optional GZIP ...
10
votes
4answers
988 views

Can .htaccess and .htpasswd really protect me?

I want to set up a kind of personal wiki where I can store various sensitive information. However to make it 100% portable and and just plain convineant, I want to put it on the Internet. I'm sure at ...
9
votes
2answers
1k views

Securing my web-server / website [closed]

Does anyone know of a comprehensive security guide about important basics / fundamentals which should be done to secure a web-server / website? A web link would do.
10
votes
4answers
661 views

Is displaying what server I am running on the error pages a security risk?

I just noticed that my 403 Forbidden (the default, not a custom one) page displays some server info: Apache/2.2.3 (Red Hat) Server at ... Port 80 Is revealing this information a security risk?
2
votes
1answer
820 views

Mod Security for apache2 blocks curl!

I'm trying to get my users lat and lng from their address using google's geocoding api but when mod security is enabled it prevents it and the script timesout. How can I add an exception by ip or ...
7
votes
5answers
1k views

Master thesis topic - mod_security

I've been playing with mod_security for some time and I'd like somehow to use it in my master thesis. I don't know exactly how this work could be more interesting than describing what mod_security ...
22
votes
8answers
9k views

Can I detect web app attacks by viewing my Apache log file?

I occasionally get clients requesting I look at their access_log file to determine if any web attacks were successful. What tools are helpful to discern attacks?
75
votes
14answers
16k views

Apache Server Hardening

What are some best practices, recommendations, required reading for securing an Apache Server?