Questions about the security of Apache open source software, especially Apache HTTP Server
58
votes
12answers
10k views
Apache Server Hardening
What are some best practices, recommendations, required reading for securing an Apache Server?
13
votes
3answers
4k views
Is there a way to mitigate BEAST without disabling AES completely?
It seems that the easiest way to protect users against the BEAST attack on TLS <= 1.0 is to prefer RC4 or even disable all other (CBC) cipher suites altogether, e.g. by specifying something like
...
8
votes
2answers
587 views
HSTS extra security over HTTPS
Is HSTS good to use even if my servers are configured to use HTTPS (Even if HTTP is used, the rewrite rules in apache makes it to HTTPS)
Also does HSTS make even the resources like CSS, images to be ...
29
votes
9answers
1k views
Use additional “password” in Referer to hide private site?
I have a private (= I'm the only user) site at example.com/private/. Nothing else is published at this host (it's my domain).
I don't want anyone to know that there is anything at example.com, ...
5
votes
2answers
7k views
How to mitigate SSL/TLS Protocol Initialization Vector Implementation Information Disclosure Vulnerability?
Disclaimer: I'm not a sysadmin, please try to give your answers in developer friendly language ;)
I'm test scanning a fresh VPS image with Nessus and I'm getting plugin 58751. I tried figuring out ...
4
votes
3answers
293 views
Is a forced rewrite from http to https secure? What does SSLRequireSSL add?
I've read contradicting advice about forcing https connections in the following way:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
To me it seems ...
6
votes
3answers
385 views
Is displaying what server I am running on the error pages a security risk?
I just noticed that my 403 Forbidden (the default, not a custom one) page displays some server info:
Apache/2.2.3 (Red Hat) Server at ... Port 80
Is revealing this information a security risk?
1
vote
2answers
81 views
mod_spamhaus whitelist example to allow a range of ips
How would an example whitelist look like, that would whitelist a
range of all IPs from 123.123.0.0 - 123.123.255.255 ?
I have the whitelistfile in
/etc/spamhaus.wl
1
vote
0answers
184 views
How Do I Secure Apache Web Server [duplicate]
Possible Duplicate:
Apache Server Hardening
I'm going to make a web server on Apache 2.
What are the security issue I will be looking at? And how do I secure it?
I have been reading news ...
