Tips to securing the Apache Webserver

Securing Apache

Securing Apache webserver

A fresh installation of Apache will, when an error happens, show the name of your operating system, along the version of Apache. Also shown is information of which modules have been installed in the Apache webserver.
Here is how to fix that. Open the configurations file here:

$ vim /etc/apache/apache2.conf

And then find where the entry "ServerSignature" is located. It is by default set to On. You will have to change that into Off. And we will make the name of the OS suppressed, and only let the Apache as a product be shown. That happens when you write these two lines into the config file.

ServerSignature Off

ServerTokens Prod

And for hardening your webserver further, these three lines should also be added to the Apache configurations file:

TraceEnabled Off

Header unset ETag
FileETag None

Directory listings can be turned off by making an entry in httpd.conf or apache2.conf file.

 Options -Indexes

You can list the installed modules on your Apache webserver. To disable a module, you can insert a "#" at the beginning of that line and restart the service.
Write this in a terminal window:

$ grep LoadModule /etc/httpd/conf/httpd.conf

With a default installation, Apache runs its process with user nobody or daemon. It is recommended to run Apache in its own non-privileged account. For example: run-web.
Create Apache User and Group

$ groupadd run-web

$ useradd -d /var/www/ -g run-web -s /bin/nologin run-web

Now you need to tell Apache to run with this new user and to do so, we need to make an entry in /etc/httpd/conf/httpd.conf and restart the service.
Open /etc/httpd/conf/httpd.conf with vim editor and search for keyword "User" and "Group" and there you will need to specify the username and groupname to use.

User run-web

Group run-web

By using "Allow" and "Deny" we can restrict access to directories. They are written in the httpd.conf file. Here, in this example, I'll give the examples to securing the root directory.

Options None

   Order deny,allow

   Deny from all

Options "None" - will not allow users to enable any optional features. Order deny, allow - This is the order in which the "Deny" and "Allow" directives will be processed. Here it will "deny" first and "allow" next. Deny from all - This will deny request from everybody to the root directory, nobody will be able to access root directory.

You can use mod_security as a firewall for your webscripts, as it will protect the server from brute force attacks. To install the mod_security module you can use your packet installer.

Here is how to install mod_security on a Ubuntu/Debian OS.

$ sudo apt-get install libapache2-modsecurity

$ sudo a2enmod mod-security

$ sudo /etc/init.d/apache2 force-reload

To turn off CGI execution, what you really should do, if not used by your webapplication. You need to state so in the main configuration file.

Options -Includes

Options -ExecCGI

This can also be done on a per directory basis. Do like so:

Options -Includes -ExecCGI

If you allow upload to a website, you can set the maximum allowed file-size to a value between 0 (unlimited), and 2GB (2147483647 bytes). The limit can be set on a per directory basis. You write the value to the LimitRequestBody. Here we set the limit to 1MB (1024000 bytes):

LimitRequestBody 1024000

By using this directive you can set the amount of time the server will wait until it fails. The default is 300 secs. It is a good idea to set this low, on sites being subject to DDoS attacks.

TimeOut 120

MaxClients lets you set the amount of users being served simultanously. The default value is 256.

MaxClients 128

HTML


<DIV class="tabborder">
<button class="tablinks" onclick="openlanguage(event, 'source')">Project: Tabs</button>

<button class="tablinks" onclick="openlanguage(event, 'HTML')">HTML</button>

<button class="tablinks" onclick="openlanguage(event, 'CSS')">CSS</button>

<button class="tablinks" onclick="openlanguage(event, 'Javascript')">Javascript</button>

</DIV>

CSS


.tablinks {
    background-color:#FFFFFF;
    border-top:2px solid #000000;
    border-left:2px solid #000000;
    border-right:2px solid #000000;
    border-bottom:none;
    border-radius:0px 10px 0px 0px;
}
.tabborder{
    border-bottom:2px solid #000000;
}

Javascript


function openlanguage(evt, openlanguage) {

var i, tabcontent, tablinks;



tabcontent = document.getElementsByClassName("tabcontent");



for (i = 0; i < tabcontent.length; i++) {

tabcontent[i].style.display = "none";

}



tablinks = document.getElementsByClassName("tablinks");



for (i = 0; i < tablinks.length; i++) {

tablinks[i].className = tablinks[i].className.replace(" active", "");

}



document.getElementById(openlanguage).style.display = "block";

evt.currentTarget.className += " active";

}

Securing Apache

HTML

CSS

Javascript

PHP