So, I've found some good articles about securing both Apache and OS X. In addition to the Security Tips in the httpd docs, I've also been looking at the following articles:
http://www.symantec.com/connect/articles/securing-apache-step-step
These articles are concerned with OS X 10.4 and Apache 1.3 but many of the concepts still seem to be applicable, namely:
- Basic Mac security: IPFW, FireVault, auto-updates and patch management, strong passwords, repairing file permissions
- Basic Apache security: limting modules to only those that are needed, unique user/group, hiding version number, limited access to filesystem
My question is, if I am using Apache just for local development and I'm not going to use it as an internet facing web server than how many of the additional security precautions mentioned in the articles (such as disabling core dumps, using Tripwire and chkrootkit, configuring mod_security, chroot etc..) are actually necessary? If I have IPFW enabled and I don't enable any port forwarding on my router, how likely is it someone could gain access through my server?
