Questions about the security of Apache open source software, especially Apache HTTP Server

learn more… | top users | synonyms

0
votes
2answers
93 views

Protecting code injection via chattr on php files?

Recently, a website I hosted (wordpress I think) for a friend got hacked and all php pages had added code at the bottom in the form of "echo base64_encode(...);". Thus there were unwanted ads on very ...
1
vote
1answer
181 views

Completely getting rid of SSLv3 on Apache

Our security team is asking that we completely disable SSLv3 on some of our servers running Apache. I've used the SSLProtocol entry in the ssl.conf file (like SSLProtocol ALL -SSLv2 -SSLv3) and ...
2
votes
0answers
85 views

CRL check for TLS client certificate on Linux?

I run a web service. Clients authenticate using a TLS Client Certificate issued by a 3rd party CA. All certificates include the CRL distribution point, but do not support OCSP. How do I configure a ...
1
vote
0answers
126 views

Which OWASP modsecurity crs version to install on apache 2.2.22

Hello I am considering installing owasp mod_security crs on an ubuntu 12.04.4 which comes with apache 2.2.22. On the github page I have seen many version's but all tutorials were using 2.2.7 First I ...
1
vote
0answers
34 views

Mysql Virtual IP and timeout

What are the risk that I encounter when increasing the timeout of a vip between a web server (apache) and mysql cluster (two servers). Actually it is set to 5 minutes. If time_out was 1hour, knowing ...
1
vote
0answers
82 views

trackback spotted in multple http errors

[Sun May 11 12:24:46 2014] [error] [client private ip] [X_FORWARDED_FOR 27.159.207.165] Path not found: /contact_us_public.php/trackback/, referer: http://www.mydomain.net/contact_us_public.php Does ...
1
vote
0answers
42 views

How to manage security for multiple PC and VM?

I have a firewall VM which creates I have used to setup subnet for different purposes. For example: (fake ips, of course) 1.1.2.1/24 DMZ 1.1.3.1/24 Internal 1.1.5.1/24 security/logging I use ...
1
vote
0answers
351 views

Nessus scanner and Red Hat backport security updates

I have asked this question: False positive Apache version in scanner results on Centos I need additional clarification: Do you know if it is possible to configure Nessus to adopt Red Hat backport ...
0
votes
0answers
123 views

Does GHOST (CVE-2015-0235) affect tomcat 7 with Java Secure Sockets Extension SSL?

If your system has certain versions (2.2 - 2.17) of glibc then it has the GHOST vulnerability. However, an attacker who does not otherwise have access to your system cannot take advantage of that ...
0
votes
0answers
47 views

Can't get my SSL CA to work with Apache

So I have an SSL enabled website running on Apache2. https://eamorr.com (I get a warning in my browser, as expected) I have a config file for this website at: ...
0
votes
0answers
249 views

Current State of BREACH (GZIP SSL Attack)?

It has been one year since BREACH made our way into our hearts, and there does not seem to be any articles or posts or patches since then, is my Google-fu weakening? Has BREACH been mitigated or ...