Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can i make sure that my apache config is secure? i mean against attacks and so on...

share|improve this question
add comment

6 Answers 6

up vote 1 down vote accepted

Some generic (not apache-only) hints:

The best solution is to be sure you really understand everything you have in your configuration file. Apache httpd doesn't help much, as its configuration file syntax and logic is much more complicated that it could be. Anyway, try not to reuse (cut&paste) configuration you don't understand, especially from systems quite different from yours. Do not load or enable any modules you don't need for your server operations. And when enabling more privileges for some clients or resources try keeping the rules as specific as possible.

When using default config files that comes with your distribution you usually may assume it is secure even if you don't quite understand it. Though, you should take care adding your code, that it will interact with the default config – e.g. even if you don't grant access to some directory (e.g. some /cgi-bin/), it could be granted by the distribution defaults.

share|improve this answer
    
Thanks for the reply! i never copy and paste stuff on the config. unless i know the pros and cons of what it does/may do... so i guess im off to research... –  msalem Feb 27 '10 at 11:03
add comment

If your O/S supports it the configuration and content should be read-only for the user id the server is running as. Only directories known to be required for dynamic content generated by Apache should be writable by Apache. Limit the file types servable from these directories.

share|improve this answer
add comment

Not a trivial question - there are so many factors to consider and it depends on your setup and requirements as well.

You need to do some background reading and research first.

It may also be beneficial, to guide your understanding, to run some sort of scanner over YOUR system - like Nikto or one of the commercial PCI scanners like McAfee's (http://www.mcafeesecure.com/us/technology-intro.jsp). I use both.

share|improve this answer
add comment

The default configuration on most distros is going to be pretty secure. It's up to you to make it otherwise. ;)

So before implementing custom htaccess rules, enabling symlink support, adding new modules, etc be sure to ask yourself how that change relates to security. Research that particular directive in the context of security via google and apache.org.

The default configuration of Apache, though secure, may have modules and features you do not require. So you may wish to disable unnecessary modules, cgi support, ssi support, directory browsing, etc. There are a slew of articles available search for "hardening linux" and start with ones that don't include mod_security or re-compiling. I recommend testing each change as you make it so as to know which ones break your site.

Also, often more important that securing Apache itself is securing the content Apache serves. Read about proper site permissions and the configuration files related to the languages used (php.ini).

Sorry it's hard to be more specific without a more specific question. I obviously don't want to duplicate Google search results.

share|improve this answer
    
Thanks... Don't be sorry... your information was really helpful!!! –  msalem Feb 27 '10 at 11:02
add comment

In my experience, apache is only as secure as the content it serves. Typically that content is generated by an application (php is very popular). That's where things get really complicated. One way to help secure apache in those situations is Mod Security. http://www.modsecurity.org/

share|improve this answer
add comment

There is no single answer since there is no single configuration. Make certain you are very careful with any data accepted from the client.

The following configuration guides for Apache may be helpful, but it's up to you to understand the application you're running:

DISA Guidelines for Apache

CIS Apache Benchmarks

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.