1

To develop my website I have the pre-installed Apache set up on my Mac and didn't realize until today that the website on my Mac is actually accessible by other devices in the network, too. This is incredibly helpful for me as it makes it easier to develop for mobile devices.

On the other hand, this means, that every time I am connected to a public network (which is the case during about 6 hours per day for me), someone could access the page that I am hosting. Nothing wrong with that so far as all the information is publicly available anyway but could someone actually enter my computer from there? I SUPPOSE the hacker can't just remotely put a file on my disk and run it but would my machine now be vulnerable to threats like SQL injections or similar? Are there other attacks, one could try to get into my computer?

And what are possible security measures for this? My computer is password-protected, I didn't host my website on / (typing my IP address in a browser field only returns the "It works!" as I have my website in a directory a bit deeper than that) and I will now keep apache deactivate most of the time.

2

You are correct to think that running apache on a public network could create security issues. Bearing in mind, if for whatever reason you are hosting webscripts that are vulnerable to attacks like SQL injection and similar, they could leave your system open to exploitation.

By default apache would be bound to 0.0.0.0 which is to say all available interfaces. Configure apache to bind to local host (or 127.0.0.1) - this way the web server will be available only from on the computer itself, and not from outside.

If you are going to insist on leaving it bound to to all network interfaces then best practice would be exactly the same as for an actual website. Use the most up to date security practices, don't run dodgy code, and make sure that information is encrypted if possible/necessary.

The possible attack vectors in this scenario rely a lot upon the code that are you are running.

2

Running a server that is exposed to other users/computers is always a security risk. In practice, this risk is minimized by using good security habits such as keeping the software updated, and only running trusted secure apps. Apache is a big program, it contains security vulnerabilities that are outside of your control (think, not yet discovered).

For a development machine, minimizing external access is the best practice. Bind Apache to 127.0.0.1, or set an appropriate firewall rule. Your computer would be vulnerable to any errors in your webapp, be they SQL injection, remote code execution, whatever... that is up to you as a programmer. Probably nobody in the coffee shop will be doing the work to hack your webapp, but some defense in depth would be well applied anyways.

Have you considered using a portable NAT/WiFi/firewall gizmo to protect your development and testing devices?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.