Downloaded 81 times
![OTHER APACHE CONFIG * Bewarec of certain RewriteRules # INSECURE configuration, don't use! RewriteRule ^/old/directory/(.*)$ /$1 Use this # SECURE - Use RewriteRule ^/old/directory/(.*)$ /$1 [PT] * Don't use Limit/LimitExcept (conf.d/security) TraceEnable off](https://image.slidesharecdn.com/newmappingthreatsmitigatingriskandimplementing-121204074439-phpapp01/75/HARDENING-IN-APACHE-WEB-SERVER-23-2048.jpg)
Uploaded byUtah Networxs Consultoria e Treinamento
HARDENING IN APACHE WEB SERVER
The document discusses threat mapping, risk mitigation, and corrective activities for web servers, focusing on hardening techniques and tools to protect against various types of attacks. It highlights the importance of proper server configurations and provides detailed practices for securing Apache servers, including permissions, vulnerabilities, and the use of security tools. Additionally, it outlines an educational background and experience of the author, Fabio Pires, in Linux and web server consulting in Brazil.
HARDENING IN APACHE WEB SERVER
- 1. “Mapping threats, Mitigating risk and Implementing Corrective activities in Web Servers”
- 2. WHO WE ARE? FIRST SCHOOL AND CONSULTING LINUX IN BRAZIL. 17 YEARS OF PRATICE IN LINUX 12 YEARS WITH BEST LINUX IN BRAZIL MORE THAN 50.000 STUDENTS TRAINED MORE THEAN 5.000 CLIENTS TO DIFERENT PROJECTS LPI-C ATP IN BRAZIL MORE: www.utah.com.br
- 3. SOCIAL MEDIA Follow! @fabioandpires Follow!@utah_networxs Enjoy! Utah Networxs
- 4. Speaker: Fabio Pires Mini Curriculum: Graduated in Computer Science Graduated in Bachelor of Computing Post Graduate in Project Analysis and Systems - FATEC Post Graduate in S.O. Linux - UFLA LPIC Teacher of Undergraduate and Graduate Twitter in Spare Time Contact: fpires@utah.com.br
- 5. TARGET “PRESENT ONE AMONG SEVERAL SOLUTION FOR BUILDING WEB SERVER" hardening "THROUGH THE USE OF TOOLS FREE TO MINIMIZE IMPACTS OF ATTACKS."
- 6.
- 7.
- 8. OPEN SOURCE WEBSERVER ARCHITECTURE
- 9. VULNERABILITY WEB APPLICATIONS
- 10. WHY WEB SERVERARE COMPROMISED?
- 11. TOOLS HTTP PRINT –BANNER WEB SERVER NIKTO - VULNERABILITIES NESSUS – VULNERABILITIES W3AF - AUDITY E EXPLORATION NMAP – SCAN PORT
- 12. MITIGATING RISKS DoS Attack DDoS Attack Brutal Force (ssh, telnet) Port Scanning Attack Ping Flooding Attack Elevation of Privilege Man in the Middle Attack Directory Transversal Password Cracking (Spoofing, Phising, Trojar Horse)
- 13. DEPLOYING CORRETION What’s Hardening ? Is a process of mapping of threats, risk mitigation and implementation of corrective activities, focusing on infrastructure and primary goal to make it ready to face attempts to attack.
- 14. PRATICE IN WEBSERVER APACHE Where you search packages ? - Packages Repository - Md5SUM Verified - Security Update - Pré-Compiled Package or Source Package
- 15. PRATICE IN WEBSERVER APACHE #CHROOT JAIL
- 16. CHROOT ARCHITETURE APACHE / bin boot chroot dev dev etc etc home lib lib mnt opt usr proc root var sbin tmp usr var
- 17. DISABLE UNUSED MODULES suexec userdir cgi / cgid autoindex
- 18. RESTRICT RESOURCES Number Of Process: With RES=7000k, SHR=2500k and 400M available for Apache, the result is: 400/(7-2.5) = 89. RES=Resident
- 19.
- 20. RESTRICT INCOMMING CONNECTIONS # iptables -I INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 25 -j REJECT --reject-with tcp-reset
- 21. FILE PERMISSIONS # find/srv/www -user utahuser # find /srv/www ! -type l ( -perm /o=w -o -perm /g=w -group utahgroup )
- 22. SEARCH FILES ANDSSL * Search hidden files # find /var/www -name '.?*' -not -name .ht* -or -name '*~' -or -name '*.bak*' -or -name '*.old*‘ * SSL key files * Make sure your SSL keys are only readable by the root user.
- 23. OTHER APACHE CONFIG * Bewarec of certain RewriteRules # INSECURE configuration, don't use! RewriteRule ^/old/directory/(.*)$ /$1 Use this # SECURE - Use RewriteRule ^/old/directory/(.*)$ /$1 [PT] * Don't use Limit/LimitExcept (conf.d/security) TraceEnable off
- 24. OTHER APACHE CONFIG * ServerSignature Off * ServerTokens Prod * Remove PHP scripts (test.php, info.php, i.php, php.info) * Disable directory indexing * Disable WebDAV * Enable PHP basedir * Install a Web Firewall (mod_security) l * Suhosin PHP
- 25. SUHOSIN PHP -BASIC suhosin.executor.include.max_traversal =4 (../../../../) suhosin.executor.disable_emodifier=Off (exec function) suhosin.mail.protect=2 (protect spammers attack) suhosin.memory_limit=256M suhosin.filter.action=402 (return code detect error) suhosin.upload.max_uploads=100
- 26. SUHOSIN PHP -BASIC suhosin.request.max_array_depth=4096 suhosin.request.max_array_index_length=2048 suhosin.request.max_name_length=2048 suhosin.request.max_value_length=650000 suhosin.request.max_vars=4096 suhosin.post.max_array_depth=8048 suhosin.post.max_array_index_length=1024 suhosin.post.max_name_length=2048 suhosin.post.max_totalname_length=8048 suhosin.post.max_vars=4096
- 27. OTHER APACHE CONFIG * ErrorDocument 404 errors/404.html * ErrorDocument 500 errors/500.html * ServerAdmin (Use Alias Mail) * UserDir disabled root
- 28. INSTALL PACKAGE # dpkg-i hardening-apache_beta-01.deb Albert Einstein
- 29. PROBLEMS l UNIQUE USER l INSERT DIALOG l PORTABLE OTHER DISTROS
- 30.
- 31. SOURCES OF RESEARCH APACHEFOUNDATION www.apache.org ECCOUNCIL www.eccouncil.org UTAH HARDENING COURSE www.utah.com.br IMAGES - ECCOUNCIL www.eccouncil.org