0
votes
1answer
44 views

Need help overriding a strict httpd.conf directory setting

Per requirements of a project I am working on, the apache httpd.conf must have the following restrictive setting as a security measure. <Directory /> Order Deny,Allow Deny from all ...
0
votes
3answers
101 views

Reporting Penetration Attempts to My Server

I need a log file of penetration attempts to my server. Ideally, this log should contain all attempts including logins, HTTPD activities, FTP activities, NFS, and other conventional open ports. ...
1
vote
1answer
287 views

PBKDF2 (or BCrypt) hash implementation for Apache HTTPD or APR

Does anyone know of (simple) way to use PBKDF2 or BCrypt as a password hash within Apache HTTPD. The general scenario is that I have a resource in /private that I would like to restrict to a given ...
4
votes
4answers
249 views

Who is 1014? I have no user on my system named 1014, so why is this httpd process run as 1014?

[root@home ~]# ps au | grep httpd 1014 9701 0.0 0.2 281620 3124 pts/24 Sl+ 18:41 0:00 ./bin/httpd -X root 9742 0.0 0.0 3084 720 pts/22 R+ 18:45 0:00 grep httpd By the ...
0
votes
1answer
205 views

Deny URLs with a parent .. in the path in apache

I was wondering if there was a simple way to make apache httpd deny (403) any URLs which contain a parent .. in the path. So far I have tried (ignoring the flase positives for simplicity) ...
1
vote
1answer
1k views

How to configure SSL with apache2/httpd mass virtual hosting using mod_vhost_alias

I have been searching quite a bit now but couldn't find any answers. I'm using httpd 2.2.15 and Centos 6.2. I have configured apache for mass virtual hosting. I.e.: UseCanonicalName off ...
1
vote
1answer
556 views

An attack? What are the second status codes(286, 289) for in the log (a web scan)?

Going through my assess-logs today, I found so many entries trying to access pages. (that were not present). Like robots.txt (I know what this is used for) apply favicon.ico(I know what ...
1
vote
2answers
136 views

Can httpd check permissions of private key file used with SSL certificate?

Is it possible to have httpd fail a configtest if a SSLCertificateKeyFile value exists, and points to a file with any permissions other than the minimum necessary for reading the key? I have httpd ...
2
votes
5answers
11k views

How to disable SELinux for Apache httpd only on my Fedora 14?

By following this link I am able to just turn SELinux off completely from my Fedora 14. But I wonder how could I disable SELinux only for the httpd daemon? I don't have system-config-selinux installed ...
2
votes
3answers
1k views

Apache getting hammered by nonsense requests, how to stop?

My VPS is getting hammered with attempts on random files/directories that don't exist on my server, in the order of roughly twice every second. Presumably it's just a bot trying to figure out whether ...
1
vote
1answer
490 views

Is giving read permissions on /etc/shadow to apache user a wise decision from security point of view?

I have to use PAM authentication for DAV SVN, but when everything is configured as specified in mod_auth_pam documentation, authentication does not work. After some research I realized, that for this ...
2
votes
4answers
269 views

How can you obscure the fact that you are running Apache?

How can I make it appear as though I'm not running Apache? I figure the best way is to appear as though it is another type of httpd, like lighthttpd or iis. I know that by using mod_security you ...