Apache Server Protection (3)

apache| Server Perl is a very powerful scripting language. Primarily for text processing, programmers can also use system calls through Perl scripts. If the program is poorly written, it will open the door for attackers to break into the server. Therefore, you must be careful to use Perl scripts to avoid such vulnerabilities. In Perl scripts, it is a good idea to call a special check routine to check the legality of the input before processing the request data. In addition, make sure that Apache does not run as root, and that Perl scripts are limited to running in a particular directory.

Security for SSI (Server-side Includes)

With SSI, programmers can build common routines that include these routines in their code when needed. SSI also allows for the conditional execution of external programs that an attacker could use to allow the server to execute their malicious programs. You can turn off the ability to execute an SSI file by using the INCLUDESNOEXEC directive in the access.conf file. However, this instruction will cause the server not to execute CGI scripts or programs.

Other security Tools

Using TCP wrappers and tripwire can provide additional protection for your system. You can use the TCP wrappers to control Telnet or FTP access rights. Tripwire is a data integrity detection tool that can help system administrators monitor whether the system has been altered, and you can set up a specific policy in the Tripwire configuration file to monitor whether the Web server's configuration files, data, and CGI files have been modified.

Summarize

Apache is an excellent crooked neck server, although the Apache developers are very focused on its security, but because Apache is very large, there will inevitably be security risks. The following issues need to be noted in the installation and maintenance of Apache:

Check the permissions of files and directories properly.

Httpd.conf, srm.conf, and access.conf settings are appropriate

Enables the server log file to record as much detailed information as possible.

Use password protection (. htaccess) for certain directories that require special protection.

Encapsulates a CGI script or program.

If CGI is written in Perl, examine its security in detail

Check SSI directives

Use TCP wrappers and tripwire.