4

Over the last couple of days I've been learning Apache and servers in general - I installed Apache, PHP and mySQL on my Ubuntu system and accessed my website with 'localhost'. I have always thought that when you run something as localhost, nothing ever leaves your computer and your server can't be accessed by computers in your WiFi network, let alone other computers connected to the Internet. However, I got scared when in a tutorial video I watched they told to turn off your Internet connection as soon as you install Apache. Is it justified? There are no sensitive information in the database or in /var/www, it's all dummy data just for learning purposes, but I'm worried that somebody could hack into my whole system.

Keeping in mind that I've been doing this for the last few days, should I consider myself hacked?

And to make it clear, when I run my server locally and can access it through localhost, is it available to people on the Internet?

9

have always thought that when you run something as localhost, nothing ever leaves your computer and your server can't be accessed by computers in your WiFi network

You accessing your services through localhost doesn't mean that it's running as localhost:

When starting a daemon, such as Apache and MySQL, it can run on localhost or on all interfaces. If your IP address is, say, 10.0.0.5; and Apache runs on all interfaces; you can access your pages on both http(s)://10.0.0.5 as well as 127.*. Now, even by running it on all interfaces, if you're protected by a NAT device, such as your default access points, it's unlikely that someone routes into your network. Of course, all users on the same network (WLAN, ...) could access your daemon.

The best way to check this is to run a netstat -an on your machine, the output should be something like:

$ netstat -an
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -
tcp        0      0 127.0.0.1:6379          0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN      -
tcp6       0      0 :::80                   :::*                    LISTEN      -

Here can see that SSH (22) runs on all my IPv4 interfaces, 6379 (redis) runs only accessible on localhost and http (80) runs on all IPv4 and IPv6 (:::80) interfaces.

Running them locally only depends on the deamon itself, apache allows a Listen 127.0.0.1:80 in the httpd.conf file, MySQL allows you to put a bind-address = 127.0.0.1 in the my.cnf file (under the [mysqld] directive) and so on. An additional measure you can do is to block all ports using IPTables on your interface (wlan0, eth0, ...), and only allow the services you intend to publish.

It's unsure to consider "yourself hacked". It was, if exposed, for sure subject to it. It depends if you have poor credentials, vulnerable versions, ...

  • 1
    To add on a bit: no, you probably weren't hacked: your NAT almost definitely would have blocked anything malicious, and it's unlikely that (if you were using up to date versions of Apache/MySQL/PHP with the default settings) anything you did opened up any major security holes. That said, if you have any reason to believe you were hacked, then you should take action to end any malicious activity. What action depends on why you believe you were hacked. – demize Jan 3 '17 at 18:35
  • Thanks for the detailed answer. Another question that I have: did I make it worse if I was running a popular VPN the whole time on my OS (commonly used for P2P)? – wenn Jan 3 '17 at 18:55
  • A commercial VPN running should provide some protection as they are unlikely to allow inbound connections. – Julian Knight Jan 3 '17 at 21:01
  • VPN Client or server? As Demize points out, you're limiting who can access your services. If you run some sort of VPN server, saying "here, this PC is now part ox X network" - then you, again depending on which interfaces you listen on, could be exposed to them. – ndrix Jan 3 '17 at 21:42
  • 1
    @JulianKnight: Any VPN increases the attack surface area. If it's well-protected, it may not increase by much, it is very misleading to say "provide some protection" when your computer is less protected with the VPN that it would have been without. – Ben Voigt Jan 3 '17 at 22:35
2

Many common applications are insecure by default, and if you're just writing your first PHP, it's extremely likely that it has vulnerabilities. Are any of these things that can affect your computer more than just messing up your database (which you don't care about)? Maybe, depending on what they are.

How you access the web server does not affect who else can access it; what matters is how the server is configured. Apache is usually configured by default to listen to all requests on port 80. To change this to only be accessible via localhost, change this to Listen 127.0.0.1:80.

You should also look into the firewall rules for your system, as that will provide an extra layer of protection.

1

In addition to the answers already given, I would also point out two additional things:

  • If you are running something like Windows 10, you will have automatic inbound protection anyway and nobody will be able to connect to the web service on your PC unless you responded to that ever helpful dialogue that occasionally pops up asking if you want to allow some kind of network access either on Public or Private networks. When using a Wi-Fi network that isn't yours, always make sure you set it as a Public network and don't allow Apache to talk over public networks.

    For Linux, you will have something called IPTABLES. As is generally the case with Linux, configuring this may be a little more involved but most distributions have a more friendly front end such as the command line UFW. For Linux, you should check that, again, there is no inbound connection allowed. The installation of Apache on Linux is almost certain to reconfigure IPTABLES to at least allow inbound traffic on ports 80 and 443.

    Not sure about Mac I'm afraid.

  • When on a public Wi-Fi, make sure you have no open ports if the Wi-Fi is "open", e.g. it has no encryption turned on.

  • Even an encrypted public Wifi puts you on a network with other users who you may not trust, just as you would if you shared your home wifi with neighbors. – Daniel Farrell Jan 4 '17 at 0:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.