Questions about the security of Apache open source software, especially Apache HTTP Server

learn more… | top users | synonyms

1
vote
1answer
435 views

Exclude file names from mod_security patterns

I have a question regarding mod_security. I have installed mod_security on my server and OWASP core rule set. However, now people are having trouble when accessing my page. For example, one problem ...
1
vote
0answers
62 views

HTTPS: Same certificate, different public key

I have a web server, Debian, and the site uses a HTTPS cert from Thawte. The root certificate meant to be on top of my verification chain is also on the server, in /etc/ssl/certs, because the APT ...
1
vote
0answers
82 views

How to keep my VPS server up on Hulk.py attack

This question in not duplicated, I tried everything that was published on stackexchange websites, but could not fix my problem. I have a web server. OS: Ubuntu 15.10 Configured on Apache2 Ram: 1.5 GB ...
1
vote
1answer
76 views

What type of authentication should I use, basic or digest? [duplicate]

I know that it is strongly recommended to use both basic and digest authentification with https. Many say that if you use SSL, there are no advandages in using digest auth, and basic auth is safe ...
1
vote
0answers
51 views

Make Apache server only to be avaliable for personal use? [closed]

I'm afraid if I have Apache active that someone can hack into my computer so everytime I had Apache active I went offline (I also installed XAMPP on USB stick because of that fear). How can I make ...
1
vote
0answers
123 views

How to recreate the Freak attack?

Currently I am trying to recreate the Freak attack on a virtual machine. For this purpose I set up a Linux Mint 17.1 system with Apache 2.4.7 (with a self signed certificate) and OpenSSL 1.0.1f. I ...
1
vote
0answers
97 views

Can't get my SSL CA to work with Apache

So I have an SSL enabled website running on Apache2. https://eamorr.com (I get a warning in my browser, as expected) I have a config file for this website at: ...
1
vote
0answers
109 views

Kerberos based infrastructure with artifactory repo for our java artifcts with Apache reverse proxy and mod auth kerb. how can I access with gradle? [closed]

We recently migrated our company to a kerberos-based infrastructure. I successfully set up an Artifactory repo for our java artifacts, with Apache reverse proxy and mod_auth_kerb. How can I access ...
1
vote
1answer
3k views

removing SSLv3 does not seem to fix POODLE problem [duplicate]

I have removed SSLv3 from my Apache 2.2.15 ssl.conf file with the line SSLProtocol All -SSLv2 -SSLv3 I have restarted httpd but POODLE tests still show vulnerability exists with POODLE. What else ...
1
vote
1answer
130 views

Apply SSL for domain that I do not own

As part of a project that my company is doing, we need to setup a development server. Let's say our company's main domain is example.com We need to be able to access the dev server through ...
1
vote
1answer
424 views

Securely send password to script as parameter

I have an expect script on my server which opens a WebDAV connection to another server, expects a username and password, and then sends $arg1 and $arg2 as the username and password respectively. ...
1
vote
0answers
229 views

Which OWASP modsecurity crs version to install on apache 2.2.22

Hello I am considering installing owasp mod_security crs on an ubuntu 12.04.4 which comes with apache 2.2.22. On the github page I have seen many version's but all tutorials were using 2.2.7 First I ...
1
vote
0answers
49 views

Mysql Virtual IP and timeout

What are the risk that I encounter when increasing the timeout of a vip between a web server (apache) and mysql cluster (two servers). Actually it is set to 5 minutes. If time_out was 1hour, knowing ...
1
vote
1answer
1k views

Strange bug in ModSecurity with the rule 950901

I have a classic ModSecurity configuration (apt-get...) SecRuleEngine Off SecPcreMatchLimit 1000 SecPcreMatchLimitRecursion 1000 SecAction "phase:1,t:none,nolog,pass, \ ...
1
vote
0answers
97 views

trackback spotted in multple http errors

[Sun May 11 12:24:46 2014] [error] [client private ip] [X_FORWARDED_FOR 27.159.207.165] Path not found: /contact_us_public.php/trackback/, referer: http://www.mydomain.net/contact_us_public.php Does ...
1
vote
0answers
49 views

How to manage security for multiple PC and VM?

I have a firewall VM which creates I have used to setup subnet for different purposes. For example: (fake ips, of course) 1.1.2.1/24 DMZ 1.1.3.1/24 Internal 1.1.5.1/24 security/logging I use ...
1
vote
1answer
157 views

How to Minimize Apache Loadable Modules (serving MediaWiki)

According to Guide to the Secure Configuration of Red Hat Enterprise Linux 6, there is this policy: "In certain scenarios, it is beneficial to remove certain httpd modules to limit the functionality ...
1
vote
1answer
2k views

WSO 2.5 Found on Apache

I have found on my web server the file wp-conf.php which when you call it from the browser with a url parameter like wp-conf.php?t7831n=any value shows an interface where you can control the entire ...
1
vote
0answers
208 views

How Do I Secure Apache Web Server [duplicate]

Possible Duplicate: Apache Server Hardening I'm going to make a web server on Apache 2. What are the security issue I will be looking at? And how do I secure it? I have been reading news ...
0
votes
2answers
1k views

Weird IP addresses showing up on my server

I have a personal server located in the US, I use it to execute code which requires a lot of resources. I sometimes have apache running on my server, to test php code. I recently left my apache server ...
0
votes
1answer
411 views

Google Chrome obsolete cryptography

I have a apache server running and following configuration for ssl: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" SSLProtocol -all +TLSv1.2 SSLCompression Off ...
0
votes
4answers
3k views

How to secure MySQL database usernames and passwords within a php file? [duplicate]

I am working on a PHP website and my researches showed that it is entirely possible that the server can get hacked and the PHP files may get exposed. I store the MySQL DB Username and Password within ...
0
votes
1answer
486 views

suspicious http request in logs

I found this request in my Ubuntu 14.04 apache2 access.log: xxx.228.207.244 - - [25/Sep/2014:17:52:03 -0400] "GET ...
0
votes
3answers
5k views

How to filter POST requests before they reach PHP on Apache?

I have done URL filtering with .htaccess (using learning and generator), however I am still concerned that any POST request can be submitted to the PHP even there is only one POST form on the website, ...
0
votes
2answers
78 views

“CHANGELOG.txt” in Apache logs

Recently I've been seeing a major uptick in the following type of requests to my Apache logs: "GET /CHANGELOG.txt HTTP/1.1" 404 211 About a month ago, I received none. Now I receive a dozen or ...
0
votes
1answer
142 views

.htaccess protected folder except IP

I created an e-shop with e-books and they are stored in specific folder which is protected by a .htaccess file : Order deny,allow deny from all allow from 127.0.0.1 The IP is the IP of the webpage, ...
0
votes
2answers
321 views

Security risk of using virtual hosts for public and internal sites

I have an Apache server which hosts a public website and an internal website. However, since Apache denotes virtual hosts based on the Host HTTP header, couldn't someone on the Internet request my ...
0
votes
2answers
397 views

Clarifying MITM attacks and Digital Certificate requirement

We are running a Portal application for our client with Payment Gateway integrated. Payment gateway uses SSL as it is suppose to be . The concern for me is that our Portal application does not use ...
0
votes
1answer
219 views

Dangers of PHP uploading word docs into a quarantine

I plan to write a PHP script which will allow web users to upload MS Word formatted docs. Here are the precautions I am taking: Filenames will be created by me (something like YYYY-MM-DD.doc) Files ...
0
votes
1answer
314 views

Strange access in apache's access.log

Does anyone know what that means? I found those today on apache's access logs. Thanks! XX.82.64.68 - - [18/Jan/2016:14:30:45 -0800] "GET /wp-content/themes/Akhbar24/images/alemarah.jpg HTTP/1.0" 404 ...
0
votes
1answer
99 views

When can the exploit for CVE: 2006-7098 be used?

I'm studying the vulnerabilities of an old version of Apache, the 1.3.34. And I don't quite understand in what exact situation the CVE 2006-7098 vulnerability can be exploited. The README included in ...
0
votes
3answers
2k views

Prevent a server side script from a direct URL access

There is a server side script written in php(say backend_file.php) or coldfusion(say backend_file.cfm). Lets say, i am using Apache and I have a sample web folder (on my Localhost) like: ...
0
votes
1answer
547 views

501 Not Implemented ServerInfo.jsp

I looked at my logs from amazon ec2 instance and found the following lines: 94.177.121.102 - - [29/Mar/2014:08:50:52 +0000] "XGET /web-console/ServerInfo.jsp HTTP/1.0" 501 418 "-" "-" 94.177.121.102 ...
0
votes
1answer
255 views

Lots of bot hits, referer seems to be the variable

I've recently (over the last 15 minutes) had quite a few hits from the same IP, it's in a country on our blacklist so they just up up on our "Access Denied" page, but I was just interested in what ...
0
votes
3answers
1k views

How to find vulnerable sites on a web server

A client of mine has a managed VPS with dozens of websites on it, maybe even hundreds. Now his server keeps getting infected on a regular basis. The webhost / server admins keep digging in the dark. ...
0
votes
2answers
491 views

How to protect files (cron files) frome being executed by everyone?

I wonder what read / write permissions should I set on my cron files (php files) so they can be executed only by our server. We're using CentOS 5.9 - 64bit and cPanel / WHM + Apache. Thanks!
0
votes
2answers
390 views

Is there an easy way to secure Apache on debian?

I run an Apache webserver with lots of PHP-sites of several customers. I tried install apache-mod_security2 after this (german) tutorial that is using these rulesets: ...
0
votes
1answer
75 views

What is the most valuable file you can get using a directory traversal hole [closed]

I am doing a penetration test and I found a directory traversal hole in the web application which enables me to download any readable file in the server. However, I could only download files that is ...
0
votes
1answer
327 views

How to implement token based api for rest api in java?

I am working on a project, and I came here in this moment, where I now need authorization. I am using Apache Shiro for my web interface, but as long as mobile web-apps are concerned, I hardly think ...
0
votes
1answer
1k views

PHP mallware attack [duplicate]

I'm desprate because my site has been attacked by some malware that adds code below on every php files. I tried to edit and chmod the infected file but its coming back. Scanning with ClamAV found ...
0
votes
1answer
236 views

How do configure Apache to resolve 'Missing Cross-Frame Scripting Defence' by app scan [closed]

There is an apache server hosting some website written in PHP and is accessible thru internet. How do configure the apache to resolve 'Missing Cross-Frame Scripting Defence' and can 'Missing ...
0
votes
1answer
41 views

apache rewriterule htaccess security

If I configure an .htaccess like this : RewriteEngine On RewriteRule ^([^/]*)$ /view.php?key=$1 [L] Which transforms original URL http://www.test.com/view.php?key=123 rewritten URL ...
0
votes
1answer
3k views

is HttpOnly and Secure cookie enough to prevent CSRF in rest api?

I created one RESTful API using spring. I am transmitting a secret key as HttpOnly & Secure cookie with login response. After login every rest request will check with that cookie and update it ...
0
votes
3answers
798 views

Securing apache by IP with .htaccess

I have a folder that I don't want to be accessible from outside my network's LAN. It seems like all traffic from the outside world goes through my firewall (192.168.1.39). So I made my .htaccess as ...
0
votes
2answers
282 views

how to block ip from head or ping or get or post to webserver (using apache and windows)?

am using apache 2.4.9 latest with windows 7 i am using some modules like limitipconn_module security2_module but using wireshark i get unlimited request to busy my webserver (DOS) from some ip ...
0
votes
1answer
180 views

Apache redirecting to unsecure port

I have setup a test website in order to play around setting up SSL. The website is setup on a Windows host with Apache 2.2.20 with OpenSSL 0.9.8r, MySQL 5.5.37, PHP 5.3.28. The URL to the home page ...
0
votes
1answer
2k views

Apache 2.2 mod_ssl configuration Forward Secrecy/BREACH/BEAST/CRIME

I am looking for mod_ssl configuration which protects against common attacks like Breach, Beast and Crime. I already disabled gzip to avoid Crime but I'm unsure about the others. RC4 should only be ...
0
votes
2answers
194 views

Does the Heartbleed vulnerability affect signed java applets [closed]

I have a Windows based server that serves a signed JAVA applet. The website isn't secured (HTTP), but all JAVA applets have to be signed now, so the site serves a signed JAVA applet as part of a web ...
0
votes
1answer
779 views

ssl client authentication: check only one certificate VS certs signed from a ca

i'm about to secure a webservice with client authentication. (apache2, mod_ssl, openssl). from what i googled, i found that it's more common to have a ca, which signs the client certs, which will ...
0
votes
1answer
70 views

Security implications of putting virtual hosts source code in /var/www/[domain]

A friend pointed out that putting virtual hosts as sub folders of the default /var/www was a bad idea. (linux example path; this applies to all OS) I see that it's possible to reach the virtual hosts ...