Apache Server Protection

apache| Server Author: nixe0n

I. Overview

This article discusses security issues with the Apache Web server installation and configuration under the UNIX platform. We assume that the system administrator reading this article has selected the relevant modules for their own site, and that they are able to configure, create, and troubleshoot problems. The main purpose of this article is to help you resume a secure Apache crooked neck (Web:P) server.

In many Web server products, Apache is one of the most widely used products, but also a very safe design program. However, like other applications, Apache also has a security flaw. This article focuses on three security flaws, including: Denial-of-service attacks using the HTTP protocol (Denial of service), 3 buffer overflow attacks, and the attacker obtaining root privileges. Note: A reasonable configuration protects Apache from multiple attacks, but denial of service attacks on the network layer are not able to be prevented by tuning Apache configuration. This article deals with denial of service attacks using the HTTP (application tier) protocol.

Two. The main flaws of Apache

· HTTP denial of Service

The attacker has some means of denying the server the answer to HTTP. This will increase the demand for system resources (CPU time and memory) in Apache, eventually causing the system to become slow or even completely paralyzed.

· Buffer overflow

The attacker uses some of the bugs written by the program to deflect the program from its normal process. The program uses statically allocated memory to hold the request data, and an attacker can send an extra long request to overflow the buffer. Like some Perl-written gateway script that handles user requests. Once the buffer overflows, an attacker can execute its malicious instructions or cause the system to go down.

· The attacker obtains root privileges

Apache typically runs as root (the parent process), and the attacker obtains root permissions and then controls the entire system.

Three. Get the latest Apache

Using the safest version is critical to securing your Apache Web server.

You can get the latest version of Apache from the official Apache website http://www.apache.org.

Protection of configuration files

The Apache Web server has three main configuration files, which are typically located in the/usr/local/apache/conf directory. These three documents are: Httpd.con, srm.conf and access.conf. These files are the control center of the entire Apache, so you need to know about three profiles. The httpd.conf file is the primary configuration file; srm.conf allows you to fill in the resource file; access.conf set the access rights for the file. The configuration of these files can refer to http://httpd.apache.org/docs/mod/core.html.

Server access Control

The access.conf file contains instructions to control what users are allowed to access the Apache directory. You should take the deny from all as the initialization instruction, and then use the Allow from command to open the access permission. You can allow access from a domain, IP address, or IP segment. For example:
　　
　　
Order Deny,allow
Deny from all
Allow from sans.org
　　
　　

Password protection

With the. htaccess file, you can assign access rights to a directory to a user. The system administrator needs to open the access control of the directory using the ACCESSFILENAME directive in the httpd.conf or srm.conf file. The following is a. htaccess sample file:

AuthName Privatefiles
AuthType Basic
Authuserfile/path/to/httpd/users
Require Foo <---a valid user name

Then, use the following command to fill in a User:

# htpasswd-c/path/to/httpd/users foo

Apache log file

The system administrator can use log format directives to control the log file information. The IP address and hostname of the HTTP request browser can be logged to the log file using the Logformat "%a%l" directive. For security reasons, you should have at least those web users who failed to authenticate, adding Logformat "%401u" instructions to the http.conf file to achieve this. There are many other parameters to this directive, and the user can refer to the Apache documentation. In addition, Apache error log files are also important for system administrators, and error log files include information such as Server startup, shutdown, and CGI execution failures.

Security-related Directives

In the Apache configuration file, there are some security-related directives to use. The detailed usage of these instructions can refer to http://httpd.apache.org/docs/mod/directives.html.

Use the following directives to help you reduce the threat of denial of service:

Limitrequestbody: Numeric parameter that controls the size of the HTTP request.
Limitrequestfields: Numeric parameter that controls the number of request headers.
KeepAlive: Sets the lifetime of the connection.
KeepAliveTimeout: Limits the time to wait for a request.

Use the following instructions to help you clamor for the danger of a buffer overflow:

Limitrequestfieldsize: Limits the size of each request header.
Limitrequestline: Limits the size of each request line.

Security threats for CGI (Ommon Gateway Interface, Universal Gateways Interface)

CGI security is so important that attackers can use CGI bugs to get system information, execute system commands, and consume system resources. If a CGI program uses statically allocated memory, it may provide an opportunity for a buffer overflow attack. To mitigate this risk, programmers should use dynamically allocated memory in CGI code. In addition to the CGI writers should be aware, the system administrator can take the CGI encapsulation (such as: suEXEC or CGI Wrap) to enhance the security of the CGI. In this way, the CGI program can run with a separate user right, and even if a buffer overflow occurs, it affects only that user's directory/file.

Perl is a very powerful scripting language. Primarily for text processing, programmers can also use system calls through Perl scripts. If the program is poorly written, it will open the door for attackers to break into the server. Therefore, you must be careful to use Perl scripts to avoid such vulnerabilities. In Perl scripts, it is a good idea to call a special check routine to check the legality of the input before processing the request data. In addition, make sure that Apache does not run as root, and that Perl scripts are limited to running in a particular directory.
Security for SSI (Server-side Includes)

With SSI, programmers can build common routines that include these routines in their code when needed. SSI also allows for the conditional execution of external programs that an attacker could use to allow the server to execute their malicious programs. You can turn off the ability to execute an SSI file by using the INCLUDESNOEXEC directive in the access.conf file. However, this instruction will cause the server not to execute CGI scripts or programs.

Other security Tools

Using TCP wrappers and tripwire can provide additional protection for your system. You can use the TCP wrappers to control Telnet or FTP access rights. Tripwire is a data integrity detection tool that can help system administrators monitor whether the system has been altered, and you can set up a specific policy in the Tripwire configuration file to monitor whether the Web server's configuration files, data, and CGI files have been modified.
Summarize

Apache is an excellent crooked neck server, although the Apache developers are very focused on its security, but because Apache is very large, there will inevitably be security risks. The following issues need to be noted in the installation and maintenance of Apache:

· Check the permissions of files and directories properly.
· Httpd.conf, srm.conf, and access.conf settings are appropriate
· Enables the server log file to record as much detailed information as possible.
· Use password protection (. htaccess) for certain directories that require special protection.
· Encapsulates a CGI script or program.
· If CGI is written in Perl, examine its security in detail
· Check SSI directives
· Use TCP wrappers and tripwire.