Win2000 Apache PHP MySQL installation and Security Manual

Look:

This article is intended for setting up a secure web platform on Win2k.
RequiredProgram:

Apache
Http://www.apache.org/dist/httpd/binaries/win32/
We choose apache_1.3.28-win32-x86-no_src.msi or apache_2.0.47-win32-x86-no_ssl.msi
Yes. Do not use lower-version programs. They are defective and are vulnerable to Internet attacks.

PHP
Http://cn2.php.net/get/php-4.3.3-Win32.zip/from/a/mirror
Php-4.3.3

MySQL
Http://www.mysql.com/get/Downloa... 5-win.zip/from/pick
Mysql-4.0.15
Note: MySQL versions earlier than this version are defective. Do not use

Zendoptimizer-2g012.16.1.0a-windows-i386.exe
PHP optimizer that supports encryption of PHP scripts

Mysql-front
A MySQL manager running on the MS Platform GUI, which is very easy to use

PhpMyAdmin-2.5.0-php.zip
MySQL Manager based on PHP scripts

Phpencode.exe
PHP encryption Compiler

Install ~
1. install Apache
Because the installation is simple, pass ~!, Please do not install it on the system partition.
In this way, backup, maintenance, and catastrophic recovery are advantageous.
Assume that D: \ is installed :\\
2. install PHP
For the specific installation process, see install.txt in the PHP Directory.
Note that do not use CGI
References
------------------------------------------------------------------
Title 17/2/2002
PHP for Windows arbitrary files execution (GIF, MP3)
Summary
Through PHP. EXE, an attacker can cause PHP to interpret any file as a PHP file,
Even if its extensions are not PHP. This wocould enable the remote attacker
Execute arbitrary commands, leading to a system compromise.
Details
Vulnerable systems:
PHP version 4.1.1 under Windows
PHP version 4.0.4 under Windows
An attacker can upload innocent looking files (with MP3, txt or GIF extensions)
Through any uploading systems such as webexplorer (or any other PHP program that
Has uploading capabilities), and then request PHP to execute it.
Example:
After uploading a file a \ "GIF \" extension (in our example huh.gif) that contains
PHP Code such:
#------------
<?
Phpinfo ();
?>
#------------
An attacker can type the following address to get in to cause the PHP file to be
Executed:
Http://www.example.com/php/php.exe/UPLOAD_DIRECTORY/huh.gif
Notice: PHP/php.exe is already ded in the URL.
Additional information
The information has been provided by compume and rootextractor.
PS: this problem occurs in most versions, including the latest versions. Therefore, do not install it using CGI! Remember...
3. Install MySQL
Install it to d :\\, which is also very simple. The specific process is pass.
It's just worrying about the default settings after MySQL is installed.
Reference my original Article
Bytes -----------------------------------------------------------------------------------
2002/12/21
Preface: Nothing to do, consumption of life, pain ~~~ Ah, so I wrote it. This article is no original, and it is organized!
The following elements are involved in the insecure MySQL service installed by default:
I. Default MySQL authorization table
Ii. Lack of log capability
Iii. Password leakage for my. ini files
4. Services are bound to all network interfaces by default.
V. MySQL directory permission in the default installation path
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~
I. Default MySQL authorization table
Because MySQL authenticates identity based on the MySQL database, it is also called an authorization table. All permission settings are here.
We will only discuss the most important user table. It controls accepting or rejecting connections.
Let's take a look.
Select host, user, password, delete_priv from user;
+ ----------- + ------ + ------------------ + ------------- +
| Host | user | password | delete_priv |
+ ----------- + ------ + ------------------ + ------------- +
| Localhost | root | 67457e226a1a15bd | Y |
| % | Root | Y |
| Localhost | Y |
| % | N |
+ ----------- + ------ + ------------------ + ------------- +
A quick setting window is displayed after the new version is installed to set the password.
The above is the content in the User table (Omitted) to see if there is any problem?
We know that the MySQL verification method is quite special. It is based on two pieces of information.
1. Connect from there
2. User Name
The password must be safe.
Article 2 The user root can be connected from any host without a password. The permission is all permissions. (Note: The permission here is global)
Article 3 from the local host, any user name (note: the user is blank, does not indicate that the user name is not required), password is not required, can be connected, all Permissions
Article 4 Any user name and password on any host can be connected without any permissions.
It can be seen that 2 \ 3 \ 4 is not safe, and how to attack it is not mentioned here, please refer to the data library.
If MySQL only allows local connections, delete the % of the host and the NUL (null) in the user)
Delete from user where host = '% ';
Delete from host where user = '';
The Last User table looks like this.
+ ----------- + ------ + ------------------ + ------------- +
| Host | user | password | delete_priv |
+ ----------- + ------ + ------------------ + ------------- +
| Localhost | root | 67457e226a1a15bd | Y |
+ ----------- + ------ + ------------------ + ------------- +
Finally, you need to refresh the authorization table to make it take effect immediately.
Flush privileges;
If your MySQL needs to be remotely used, add a secure password to the root account in section %.
Update user SET Password = PASSWORD ('upass ') where host =' % ';
Here, youpass is the password.
Mysql> select host, user, password, delete_priv from user;
+ ----------- + ------ + ------------------ + ------------- +
| Host | user | password | delete_priv |
+ ----------- + ------ + ------------------ + ------------- +
| Localhost | root | 67457e226a1a15bd | Y |
| % | Root | 77c590fa148bc9fb | Y |
+ ----------- + ------ + ------------------ + ------------- +
A better way is to specify the connection to the remote host as a specific
Change % in host to the host that can be connected, for example:
192.168.0.% allows a specific subnet
Www.sandflee.net allows a specific host
The default account name is also a concern. It may cause brute-force cracking.
Update user set user = 'localadmin' where host = 'localhost ';
Update user set user = 'remoteadmin' where host = '% ';
The Last User table looks like this.
Mysql> select host, user, password, delete_priv from user;
+ ----------- + ------------- + ------------------ + ------------- +
| Host | user | password | delete_priv |
+ ----------- + ------------- + ------------------ + ------------- +
| Localhost | localadmin | 67457e226a1a15bd | Y |
| % | Remoteadmin | 77c590fa148bc9fb | Y |
+ ----------- + ------------- + ------------------ + ------------- +
For more detailed information, see the MySQL Chinese Reference Manual of Yan Zi. Everything else.
Ii. Lack of log capability
After MySQL is installed, the setting file of my. ini will be generated in the directory % SystemRoot %.
The default content is as follows:
------------------------------
Basedir = C:/MySQL
# Bind-address = 192.168.0.1
Datadir = C:/MySQL/Data
# Language = C:/MySQL/share/your language directory
# Slow query log # =
# Tmpdir # =
# Port = 3306
# Set-variable = key_buffer = 16 m
[Winmysqladmin]
Server = C:/MySQL/bin/mysqld-nt.exe
User = root
Password = root
Note log # = This
It is not defined and canceled.
Change to a suitable path, for example:
Log = C:/MySQL/logs/MySQL. Log
Iii. Password leakage for my. ini files
At the end of my. ini, we can see these two sentences:
User = root
Password = root
If you use the Quick Setting feature provided by MySQL when the installation is complete, your account and password (in a newer version) will be written to the my. ini file.
This is also the winmysqladmin.exe tool written from mysqlto the Startup Group, which needs to be read during runtime. It provides MySQL services
Some monitoring functions. In this example, winmysqladmin.exe can obtain the MySQL service status information.
In fact, this is not a vulnerability. Let's take a look at the default permissions of my. ini, which can be read by users in the user group.
Resulting in password Leakage
Solution:
Set permissions for my. ini files.
Resetting accounts and passwords
Do not use Quick settings
4. Services are bound to all network interfaces by default.
The service is bound to all network interfaces. For example, you only need a MySQL service running on the Intranet, but your machine has
MySQL is bound to the external network interface, which brings unnecessary troubles and threats.
In my. ini
# Bind-address = 192.168.0.1
It is canceled by default.
Open it
If it is only used locally, change
Bind-address = 127.0.0.1
In other cases, select a suitable network interface.
V. MySQL directory permission in the default installation path
The default installation path for MySQL is c: \ mysql, which is basically rare. It is also troublesome to change, but also to change my. ini.
However, there is a problem.
Generally, c: \ has all permissions in the Everyone group. This is the default, and the data directory under MySQL is caused by inheritance.
All permissions in the Everyone group. Data may be randomly accessed, read, or deleted, and data may be leaked or damaged.
Change the MySQL directory to an appropriate and secure access permission.
Over...
Bytes -----------------------------------------------------------------------------------------
There is a small syntax error, please find it yourself :)

setup ~
three configuration documents
httpd. conf --- apache
PHP. INI ----- php
my. INI ------ mysql
1. HTTP. conf
because the MS version of Apache does not have the
user and group commands in * nix, you don't expect it to be like IIS, the server response is reported to the iusr_name account.
* nobody is used under Nix. Therefore, Apache operates with the system permission, it is not suitable for setting up and providing personal homepage servers
httpd. conf has many parameters, so you don't need to modify them to work.
The following is where you want to modify
delete all files in the htdocs directory. delete all the files under cgi-bin. They are used for testing and should not be retained.
bindaddress * -- address to be bound * Only all addresses
directoryindex index.html index.htm -- default homepage name
accessfilename. htaccess -- control file name. We recommend that you turn it off or change the name, and use \". \ "the start file name is not allowed in Windows
serversignature on -- error message, recommended off. this will not display your Apache version
---------------------------------------------------
alias/manual/\ "D: /Apache/htdocs/manual/\ "

options indexes followsymlinks Multiviews
AllowOverride none clear
order allow, deny
allow from all

---------------------------------------------
addhandler CGI-script. CGI. pl -- to support CGI, open it. Otherwise, comment it out.

Loadmodule php4_module D:/PHP/SAPI/php4apache. dll
Addmodule mod_php4.c
Addtype application/X-httpd-PHP. php -- Added support for PHP scripts
2. php. inf

Engine = on -- enable PHP support. If you do not want PHP to work, engine = OFF.
Safe_mode = off -- security mode, which should be enabled safe_mode = on
Safe_mode_exec_dir = -- sets the directory of programs that can be executed in security mode.
Disable_functions = the function to be closed. We recommend that you disable phpinfo and get_cfg_var using \ ", \".
Expose_php = on we recommend that you use expose_php = off, so that no PHP version is available in the header.
Display_errors = on display_errors = off, so that all error messages will be disabled.
Register_globals = off automatic global variables. Generally, you must enable register_globals = on. However, many
Security issues, especially some poorly written PHP scripts, may compromise your web server
File_uploads = on: Indicates whether to allow file upload. If you do not need to, off.
Allow_url_fopen = off whether to enable the function remotely. We recommend that you disable

; Extension = php_gd.dll
; Extension = php_gettext.dll
; Extension = php_hyperwave.dll
; Extension = php_iconv.dll
; extension = php_ifx.dll open some libraries that need to be supported, such as using graphical functions
copy PHP/extensions/php_gd.dll to your system directory and remove it;
restart Apache.
3. my. INI
above, pass
Security suggestion. In the preceding three settings files, set their permissions to all system permissions and all administrators permissions.

4. Enhanced security of virtual directories
Some important commands
Specific column:
<Directory \ "D:/Apache/htdocs/tools \">
Options Indexes
AllowOverride none
Order allow, deny
Allow from all
</Directory>
Php_flag engine off; disable the PHP interpreter execution function
Php_admin_value safe_mode 1; security mode 1-enable 0-Disable
Php_admin_value open_basedir D:/Apache/htdocs/tools;
In this way, PHP scripts can only open files under D:/Apache/htdocs/tools.
BelowCodeIt's useless.
-----------------------------------------------------------
$ FD = fopen ($ filename, \ "r \");
$ View = fread ($ FD, filesize ($ filename ));
Echo \ "<PRE> \";
Echo htmlspecialchars (\ "$ view \";);
Echo \ "</PRE> \";
Fclose ($ FD );
-----------------------------------------------------------
Enable APACHE-HTTP Authentication
Clear
<Directory \ "D:/Apache/htdocs/home \">
...
...
AllowOverride authconfig
</Directory>
In

Parameter AllowOverride authconfig
Note: Here, D:/Apache/htdocs/home indicates the web root directory of the Apache service I installed. Your web root directory is not necessarily the same as mine.
The default value is "AllowOverride authconfig.
Description of the AllowOverride authconfig parameter.
It means that the access control of all directories under the root directory is set by the. htaccess file under its directory.
Here, I want to talk nonsense.
Why is it. htaccess? This file name is not another one.
This is defined in the accessfilename parameter. By default, this is the case.
Accessfilename. htaccess
You need to clear the AllowOverride authconfig parameter (add # or delete)
Reasons for doing so
1. I am in trouble (A. htaccess file must be placed in each directory and a file name starting with \ ". \" is not allowed in windows .)
2. It is not safe (it may be seen .)
How to verify the directory you want to specify?
One column
<Directory \ "D:/Apache/htdocs/home \"> // define the directory path to verify
Authtype basic // method. MD5 is not supported in windows, so use basic.
Authname test // define the domain name displayed in the dialog box
Authuserfile D:/Apache/user // defines the password file
Errordocument 401 \ "error password // defines the content displayed after verification fails. Of course, it can be a file.
Require valid-user Note: Here I want it to display the error password directly, start with \ ", there is only one
</Directory>
Directly add it to the end of httpd. conf.
There is an htpasswd.exe file in the binlog of the apacheinstallation directory.
Run it in cmd.
D: \ apache \ bin> htpasswd.exe
Usage:
Htpasswd [-cmdps] passwordfile Username
Htpasswd-B [cmdps] passwordfile Username Password

Htpasswd-N [MDPs] Username
Htpasswd-Nb [MDPs] Username Password
-C create a new file. // create a new password file (you use this parameter for the first time)
-N don \'t update file; display results on stdout. // display to the screen
-M force MD5 encryption of the password (default). // The default encryption password (MD5 Mode)
-D force crypt encryption of the password. // use crypt to encrypt the password
-P do not encrypt the password (plaintext). // Unencrypted Password
-S force Sha encryption of the password. // use SHA Algorithm Encryption
-B use the password from the command line rather than prompting for it. // method of intercommunication
On Windows, TPF and Netware systems the \ '-m \' flag is used by default.
On all other systems, the \ '-p \' flag will probably not work.
--------------------------------------
Column:
D: \ apache \ bin> htpasswd.exe-c d: \ apache \ User taotao
Automatically using MD5 format on Windows.
New Password :***
Re-type new password :***
Adding password for user taotao
The creation is complete.
Note that
Passwordfile should not be placed in the web directory, because it will be downloaded and stupid, although the password has been MD5
The-C parameter is used to create a new password file.
D: \ apache \ User path.
Authuserfile D:/Apache/user settings are consistent.
Start your Apache service again

Back up your httpd. conf, PHP. ini, and my. ini

Install zendoptimizer-21_12.16.1.0a-windows-i386.exe
It automatically modifies your php. ini (C: \ winnt \ PHP. INI) file.
Added the following content:
[Zend]
Zend_optimizer.optimization_level = 15
Zend_extension_ts = \ "C: \ Program Files \ Zend \ Lib \ zendoptimizer. dll \"

Installing the PHP optimizer has many advantages.
It accelerates the running speed of PHP. The most important thing is that it can encrypt PHP scripts.
In this way, the user you wrote in the PHP script can be well protected by pass.
In addition, you can modify the Apache header and use utraedit32 to open apachecore. dll.
Search for your Apache version number and change it to another version.