Install Apache-2.4.10 + Security Configuration and apache2.4 Security Configuration on CentOS

Install Apache-2.4.10 + Security Configuration and apache2.4 Security Configuration on CentOS

 

Note: All of the following operations are performed in the CentOS 6.5 x86_64-bit system.

 

# Preparations #

Before installing Nginx, make sure that basic components are installed with yum and www users and user groups are configured. For details, see CentOS installation Nginx-1.6.2 + Security Configuration.

You also need to install the following components:

1. Install Sqllite:

# wget http://www.sqlite.org/2014/sqlite-autoconf-3080704.tar.gz# tar zxf sqlite-autoconf-3080704.tar.gz# cd sqlite-autoconf-3080704# ./configure --prefix=/usr/local/sqlite-3.8.7.4# make && make install

2. Install apr:

# tar zxf apr-1.4.5.tar.gz# cd apr-1.4.5# ./configure --prefix=/usr/local/apr-1.4.5# make && make install

3. Install apr-util:

# tar zxf apr-util-1.3.12.tar.gz# cd apr-util-1.3.12# ./configure --prefix=/usr/local/apr-util-1.3.12 --with-apr=/usr/local/apr-1.4.5# make && make install

 

# Apache installation #

Start to download Apache and compile and install it:

# cd /usr/local/src# wget http://mirrors.hust.edu.cn/apache//httpd/httpd-2.4.10.tar.gz# tar zxf httpd-2.4.10.tar.gz# cd httpd-2.4.10# ./configure --prefix=/usr/local/apache-2.4.10 --with-apr=/usr/local/apr-1.4.5 --with-apr-util=/usr/local/apr-util-1.3.12 --enable-dav --enable-so --enable-maintainer-mod --enable-rewrite --with-sqlite=/usr/local/sqlite-3.8.7.4# make && make install# cp /usr/local/apache-2.4.10/conf/httpd.conf /usr/local/apache-2.4.10/conf/httpd.conf.default# ln -s /usr/local/apache-2.4.10/ /usr/local/apache

Next, modify the http. conf configuration file:

# vim /usr/local/apache-2.4.10/conf/httpd.confListen 8888User wwwGroup wwwLoadModule dav_module modules/mod_dav.soLoadModule dav_fs_module modules/mod_dav_fs.soLoadModule rewrite_module modules/mod_rewrite.so

Note: here we configure the listening port to 8888 and enable the DAV and Rewrite modules.

Save the file and enable the apache service:

# /usr/local/apache/bin/apachectl start

Note that the new version of Apache is forbidden to start Apache as the root user, as shown below:

# ps aux | grep httpdwww      10087  0.0  0.5 221664  2960 ?        Sl   15:41   0:00 /usr/local/apache-2.4.10/bin/httpd -k startwww      10088  0.0  0.5 221664  2964 ?        Sl   15:41   0:00 /usr/local/apache-2.4.10/bin/httpd -k startwww      10089  0.0  0.7 287200  3528 ?        Sl   15:41   0:00 /usr/local/apache-2.4.10/bin/httpd -k startwww      10171  0.0  0.5 221664  2968 ?        Sl   15:41   0:00 /usr/local/apache-2.4.10/bin/httpd -k startroot     12966  0.0  0.7  98588  3872 ?        Ss    2014   0:15 /usr/local/apache-2.4.10/bin/httpd -k startroot     10331  0.0  0.1 103252   836 pts/0    S+   15:49   0:00 grep httpd

Note: An httpd process is root, which is normal. After startup, the root will fork the process with the ww permission, and the user's request will be handled by the www permission process.

In this case, open the browser access address http: // youripaddress: 8888/and you can see:

So far, Apache has been installed and started successfully.

 

# Apache Security Configuration #

1. Apache allows directory browsing by default. If there is no index file in the directory, the directory browsing vulnerability may occur. Therefore, you need to disable directory browsing here. Select Global shutdown:

# vim /usr/local/apache/conf/httpd.conf<Directory "/usr/local/apache-2.4.10/htdocs">    Options Indexes FollowSymLinks    Require all granted</Directory>

Note: If the original Indexes is changed to-Indexes, you can disable this function in the. htacess file or delete the Indexes line directly.

2. the banner output by Apache by default will leak key information, such as the Server OS type and Apache version. This information cannot be output:

# vim /usr/local/apache/conf/httpd.confServerSignature OffServerTokens Prod

Note: add content directly at the end of the file.

3. Enable access logs and correctly configure the path (enabled by default ):

# vim /usr/local/apache/conf/httpd.conf<IfModule log_config_module>    CustomLog "logs/access_log" common</IfModule>

4. Ensure Directory Security. Because Apache is started by www users, you can set the owner of Web directories and files as root users, and set the permission to 755 for Web directories, the permissions for Web files are set to 644 (for cgi files to be executed, set to 755). Only the read and write permissions required for the upload directory are set to 777.

# chown -R root:root /data/www/# chmod 755 /data/www/# chmod -R 777 /data/www/upload

In addition, to prevent hackers from uploading executable scripts to the 777 directory, you must set this directory as not executable or accessible scripts, such:

# vim /usr/local/apache/conf/httpd.conf<Directory "/usr/local/apache/htdocs/yourpath">    Options None    AllowOverride None    Order deny,allow    Deny from all    <FilesMatch "\.(jpg|jpeg|gif|png)$">        Order deny,allow        Allow from all    </FilesMatch></Directory>

5. Set access IP address list restrictions for the management directory, for example:

# vim /usr/local/apache/conf/httpd.conf<Directory "/usr/local/apache/htdocs/admin">Order deny,allowDeny from allAllow from pair 11.12.23.0/24</Directory>

6. Remove the UserDir function (disabled by default ).