Questions about the security of Apache open source software, especially Apache HTTP Server

learn more… | top users | synonyms

1
vote
1answer
146 views

How to Minimize Apache Loadable Modules (serving MediaWiki)

According to Guide to the Secure Configuration of Red Hat Enterprise Linux 6, there is this policy: "In certain scenarios, it is beneficial to remove certain httpd modules to limit the functionality ...
1
vote
1answer
1k views

WSO 2.5 Found on Apache

I have found on my web server the file wp-conf.php which when you call it from the browser with a url parameter like wp-conf.php?t7831n=any value shows an interface where you can control the entire ...
1
vote
0answers
208 views

How Do I Secure Apache Web Server [duplicate]

Possible Duplicate: Apache Server Hardening I'm going to make a web server on Apache 2. What are the security issue I will be looking at? And how do I secure it? I have been reading news ...
0
votes
2answers
1k views

Weird IP addresses showing up on my server

I have a personal server located in the US, I use it to execute code which requires a lot of resources. I sometimes have apache running on my server, to test php code. I recently left my apache server ...
0
votes
3answers
3k views

Disadvantages of disabling RC4 in SSL/TLS [closed]

Other than requiring more server resources, are there any disadvantages of disabling RC4 from being using by an Apache webserver? My primary concern is preventing access from older browsers.
0
votes
2answers
1k views

Running Apache as system service on Windows 2003 R2 64-bit

Trying to make my point, that running Apache with PHP5 module as Windows service is not secure. All I got to prove it - FTP access to some internal website. So what I did - I uploaded file test.php ...
0
votes
1answer
340 views

Google Chrome obsolete cryptography

I have a apache server running and following configuration for ssl: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" SSLProtocol -all +TLSv1.2 SSLCompression Off ...
0
votes
4answers
2k views

How to secure MySQL database usernames and passwords within a php file? [duplicate]

I am working on a PHP website and my researches showed that it is entirely possible that the server can get hacked and the PHP files may get exposed. I store the MySQL DB Username and Password within ...
0
votes
2answers
186 views

How to prevent Cookie-Bombs?

Egor Homakov made a nice writeup (Cookie Bomb or let's break the Internet) on how to crash CDNs and other websites with cookies. Although this is a user/browser-side DOS, I'm wondering how one would ...
0
votes
1answer
437 views

suspicious http request in logs

I found this request in my Ubuntu 14.04 apache2 access.log: xxx.228.207.244 - - [25/Sep/2014:17:52:03 -0400] "GET ...
0
votes
3answers
5k views

How to filter POST requests before they reach PHP on Apache?

I have done URL filtering with .htaccess (using learning and generator), however I am still concerned that any POST request can be submitted to the PHP even there is only one POST form on the website, ...
0
votes
1answer
122 views

.htaccess protected folder except IP

I created an e-shop with e-books and they are stored in specific folder which is protected by a .htaccess file : Order deny,allow deny from all allow from 127.0.0.1 The IP is the IP of the webpage, ...
0
votes
2answers
258 views

Security risk of using virtual hosts for public and internal sites

I have an Apache server which hosts a public website and an internal website. However, since Apache denotes virtual hosts based on the Host HTTP header, couldn't someone on the Internet request my ...
0
votes
2answers
391 views

Clarifying MITM attacks and Digital Certificate requirement

We are running a Portal application for our client with Payment Gateway integrated. Payment gateway uses SSL as it is suppose to be . The concern for me is that our Portal application does not use ...
0
votes
1answer
202 views

Dangers of PHP uploading word docs into a quarantine

I plan to write a PHP script which will allow web users to upload MS Word formatted docs. Here are the precautions I am taking: Filenames will be created by me (something like YYYY-MM-DD.doc) Files ...
0
votes
1answer
140 views

Strange access in apache's access.log

Does anyone know what that means? I found those today on apache's access logs. Thanks! XX.82.64.68 - - [18/Jan/2016:14:30:45 -0800] "GET /wp-content/themes/Akhbar24/images/alemarah.jpg HTTP/1.0" 404 ...
0
votes
1answer
94 views

When can the exploit for CVE: 2006-7098 be used?

I'm studying the vulnerabilities of an old version of Apache, the 1.3.34. And I don't quite understand in what exact situation the CVE 2006-7098 vulnerability can be exploited. The README included in ...
0
votes
3answers
2k views

Prevent a server side script from a direct URL access

There is a server side script written in php(say backend_file.php) or coldfusion(say backend_file.cfm). Lets say, i am using Apache and I have a sample web folder (on my Localhost) like: ...
0
votes
1answer
503 views

501 Not Implemented ServerInfo.jsp

I looked at my logs from amazon ec2 instance and found the following lines: 94.177.121.102 - - [29/Mar/2014:08:50:52 +0000] "XGET /web-console/ServerInfo.jsp HTTP/1.0" 501 418 "-" "-" 94.177.121.102 ...
0
votes
1answer
247 views

Lots of bot hits, referer seems to be the variable

I've recently (over the last 15 minutes) had quite a few hits from the same IP, it's in a country on our blacklist so they just up up on our "Access Denied" page, but I was just interested in what ...
0
votes
3answers
1k views

How to find vulnerable sites on a web server

A client of mine has a managed VPS with dozens of websites on it, maybe even hundreds. Now his server keeps getting infected on a regular basis. The webhost / server admins keep digging in the dark. ...
0
votes
2answers
458 views

How to protect files (cron files) frome being executed by everyone?

I wonder what read / write permissions should I set on my cron files (php files) so they can be executed only by our server. We're using CentOS 5.9 - 64bit and cPanel / WHM + Apache. Thanks!
0
votes
2answers
386 views

Is there an easy way to secure Apache on debian?

I run an Apache webserver with lots of PHP-sites of several customers. I tried install apache-mod_security2 after this (german) tutorial that is using these rulesets: ...
0
votes
1answer
916 views

PHP mallware attack [duplicate]

I'm desprate because my site has been attacked by some malware that adds code below on every php files. I tried to edit and chmod the infected file but its coming back. Scanning with ClamAV found ...
0
votes
1answer
164 views

How do configure Apache to resolve 'Missing Cross-Frame Scripting Defence' by app scan [closed]

There is an apache server hosting some website written in PHP and is accessible thru internet. How do configure the apache to resolve 'Missing Cross-Frame Scripting Defence' and can 'Missing ...
0
votes
1answer
37 views

apache rewriterule htaccess security

If I configure an .htaccess like this : RewriteEngine On RewriteRule ^([^/]*)$ /view.php?key=$1 [L] Which transforms original URL http://www.test.com/view.php?key=123 rewritten URL ...
0
votes
1answer
2k views

is HttpOnly and Secure cookie enough to prevent CSRF in rest api?

I created one RESTful API using spring. I am transmitting a secret key as HttpOnly & Secure cookie with login response. After login every rest request will check with that cookie and update it ...
0
votes
3answers
655 views

Securing apache by IP with .htaccess

I have a folder that I don't want to be accessible from outside my network's LAN. It seems like all traffic from the outside world goes through my firewall (192.168.1.39). So I made my .htaccess as ...
0
votes
2answers
251 views

how to block ip from head or ping or get or post to webserver (using apache and windows)?

am using apache 2.4.9 latest with windows 7 i am using some modules like limitipconn_module security2_module but using wireshark i get unlimited request to busy my webserver (DOS) from some ip ...
0
votes
1answer
171 views

Apache redirecting to unsecure port

I have setup a test website in order to play around setting up SSL. The website is setup on a Windows host with Apache 2.2.20 with OpenSSL 0.9.8r, MySQL 5.5.37, PHP 5.3.28. The URL to the home page ...
0
votes
1answer
2k views

Apache 2.2 mod_ssl configuration Forward Secrecy/BREACH/BEAST/CRIME

I am looking for mod_ssl configuration which protects against common attacks like Breach, Beast and Crime. I already disabled gzip to avoid Crime but I'm unsure about the others. RC4 should only be ...
0
votes
2answers
193 views

Does the Heartbleed vulnerability affect signed java applets [closed]

I have a Windows based server that serves a signed JAVA applet. The website isn't secured (HTTP), but all JAVA applets have to be signed now, so the site serves a signed JAVA applet as part of a web ...
0
votes
1answer
662 views

ssl client authentication: check only one certificate VS certs signed from a ca

i'm about to secure a webservice with client authentication. (apache2, mod_ssl, openssl). from what i googled, i found that it's more common to have a ca, which signs the client certs, which will ...
0
votes
1answer
67 views

Security implications of putting virtual hosts source code in /var/www/[domain]

A friend pointed out that putting virtual hosts as sub folders of the default /var/www was a bad idea. (linux example path; this applies to all OS) I see that it's possible to reach the virtual hosts ...
0
votes
1answer
350 views

How does a website get pass my server firewall and attempt to hotlink to my server resources?

I was stumped when I saw the following lines on my Apache server error log this morning: [authz_core:error] [client ::1:37317] AH01630: client denied by server configuration: ...
0
votes
1answer
228 views

Abusing write permission on Apache logs dir to escalete privileges

I have just come across this sentence on apache log files documentation: Anyone who can write to the directory where Apache is writing a log file can almost certainly gain access to the uid that ...
0
votes
2answers
224 views

My Apache log is kind of freaking me out [closed]

So, last night I looked at the Apache log of my shared hosting account for the first time. There was quite a lot of traffic that looked suspicious, specifically a lot of GET request from a domain, ...
0
votes
3answers
2k views

Security checklist for hosting a website on dedicated server - Linux [closed]

I have been searching for a while now. But i can't find a start-up and advanced sought-of checklist to understand the most important things to consider while going for dedicated hosting server for a ...
0
votes
1answer
128 views

How bad of a practice is it to mount tomcat's manager to Apache2?

If we take into account only security concerns, how bad of a practice is it to mount tomcat's manager to Apache2. E.g.,: JkMount /manager/html* ajp13_worker I'm doing this because my company has ...
0
votes
1answer
726 views

Mod_security rules-updater.pl fails to pull new release

Mod_security has a rules updater distributed with their release packages on sourceforge: http://sourceforge.net/projects/mod-security/files/modsecurity-crs/0-CURRENT/ Usually, you can run the script ...
0
votes
0answers
14 views

SSLVerifyClient on Apache [migrated]

Please excuse any dumb statements regarding this. I am very new to Apache and to HP-UX. I am a SQL Server DBA somehow thrown into this project. I am working to try and implement SSL with Client ...
0
votes
1answer
172 views

How to implement token based api for rest api in java?

I am working on a project, and I came here in this moment, where I now need authorization thing. I am using Apache Shiro for my web interface, but as long as mobile web-apps are concerned, I hardly ...
0
votes
0answers
130 views

Injecting meterpreter/reverse_tcp into apache2 with msfvenom results in seg fault of apache2

I've been trying to use msfvenom with the linux/x86/meterpreter/reverse_tcp payload and an apache2 binary. My intent is to create a tainted version of apache2 to establish a persistent backdoor on the ...
0
votes
0answers
48 views

Apache SSL proxy or Jetty with SSL via keystore to app?

Our team is debating two deployment methods for a RESTful web application. Run the app under http with an embedded Jetty server, but fronted by Apache - Apache would handle the SSL/TLS. Install our ...
0
votes
0answers
90 views

Correct permissions for /runtime and /assets folders

Could you suggest how to properly configure the right directories in CentOS 6.6? On a server running a framework Yii, which works with the runtime directories and assets. For these directories I need ...
0
votes
0answers
27 views

Apache.exe trojan attack on xp server, wiped it with a linux install am i safe? [duplicate]

Hello I ran a apache web server on a windows xp pc on my home network. My antivirus picked up an attack, but didn't prevent it. It seems I had a Trojan attack on my apache.exe that got through. I know ...
0
votes
0answers
86 views

Hostname based Access Controls from clients with shared IPs

I have been pondering this question for some time now: Can you really use hostnames as access controls, especially when clients might be behind proxies or routers performing NAT (or any other shared ...
0
votes
0answers
211 views

Does GHOST (CVE-2015-0235) affect tomcat 7 with Java Secure Sockets Extension SSL?

If your system has certain versions (2.2 - 2.17) of glibc then it has the GHOST vulnerability. However, an attacker who does not otherwise have access to your system cannot take advantage of that ...
0
votes
0answers
87 views

Can't get my SSL CA to work with Apache

So I have an SSL enabled website running on Apache2. https://eamorr.com (I get a warning in my browser, as expected) I have a config file for this website at: ...
0
votes
2answers
449 views

cross-signed end-entity certificates: usage in apache/openssl/gnutls

A previous question, What is the use of cross signing certificates in X.509? described cross-signed certificates well. I have a situation where the clients trust CA1 xor CA2, and both need to reach a ...