{"id":766,"date":"2015-12-09T08:32:48","date_gmt":"2015-12-09T08:32:48","guid":{"rendered":"http:\/\/adriangrigoras.com\/blog\/?p=766"},"modified":"2016-12-09T08:36:30","modified_gmt":"2016-12-09T08:36:30","slug":"13-apache-web-server-security-hardening-tips","status":"publish","type":"post","link":"https:\/\/adriangrigoras.com\/blog\/13-apache-web-server-security-hardening-tips\/","title":{"rendered":"13 Apache Web Server Security and Hardening Tips"},"content":{"rendered":"

We all are very familiar with Apache<\/strong> web server, it is a very popular web server to host your web files or your website on the web. Here are some links which can help you to configure Apache web server on your Linux box.<\/p>\n

\"Apache<\/a><\/p>\n

Apache Security and Hardening Tips<\/p>\n<\/div>\n

    \n
  1. Install Apache Web Server<\/a><\/li>\n
  2. Setup Your Website in Your Linux Box<\/a><\/li>\n<\/ol>\n

    Here in this tutorial, I\u2019ll cover some main tips to secure your web server. Before you apply these changes in your web server, you should have some basics of the Apache server.<\/p>\n

      \n
    1. Document root Directory: \/var\/www\/html<\/strong> or \/var\/www<\/strong><\/li>\n
    2. Main Configuration file: \/etc\/httpd\/conf\/httpd.conf<\/strong> (RHEL\/CentOS\/Fedora) and \/etc\/apache2\/apache2.conf<\/strong> (Debian\/Ubuntu).<\/li>\n
    3. Default HTTP Port: 80<\/strong> TCP<\/li>\n
    4. Default HTTPS Port: 443<\/strong> TCP<\/li>\n
    5. Test your Configuration file settings and syntax: httpd -t<\/strong><\/li>\n
    6. Access Log files of Web Server: \/var\/log\/httpd\/access_log<\/strong><\/li>\n
    7. Error Log files of Web Server: \/var\/log\/httpd\/error_log<\/strong><\/li>\n<\/ol>\n

      1. How to hide Apache Version and OS Identity from Errors<\/h3>\n

      When you install Apache<\/strong> with source or any other package installers like yum<\/strong>, it displays the version of your Apache<\/strong> web server installed on your server with the Operating system name<\/strong> of your server in Errors<\/strong>. It also shows the information about Apache modules installed<\/strong> in your server.<\/p>\n

      \"Show<\/a><\/p>\n

      Show Apache Version<\/p>\n<\/div>\n

      In above picture, you can see that Apache<\/strong> is showing its version<\/strong> with the OS installed<\/strong> in your server. This can be a major security threat to your web server as well as your Linux box too. To prevent Apache<\/strong> to not to display these information to the world, we need to make some changes in Apache main configuration file.<\/p>\n

      <\/center>Open configuration file with vim editor and search for \u201cServerSignature<\/strong>\u201c, its by default On. We need to Off<\/strong> these server signature and the second line \u201cServerTokens Prod<\/strong>\u201d tells Apache to return only Apache as product in the server response header on the every page request, It suppress the OS, major and minor version info.<\/p>\n
      # vim \/etc\/httpd\/conf\/httpd.conf (RHEL\/CentOS\/Fedora)\r\n# vim \/etc\/apache2\/apache2.conf (Debian\/Ubuntu)<\/pre>\n
      ServerSignature Off\r\nServerTokens Prod<\/pre>\n
      # service httpd restart (RHEL\/CentOS\/Fedora)\r\n# service apache2 restart (Debian\/Ubuntu)<\/pre>\n
      \"Hide<\/a><\/p>\n
      Hide Apache Version<\/p>\n<\/div>\n
      2. Disable Directory Listing<\/h3>\n
      By default Apache list all the content<\/strong> of Document root directory in the absence of index file<\/strong>. Please see the image below.<\/p>\n
      \"Apache<\/a><\/p>\n
      Apache Directory Listing<\/p>\n<\/div>\n
      We can turn off<\/strong> directory listing by using Options directive<\/strong> in configuration file for a specific directory. For that we need to make an entry in httpd.conf<\/strong> or apache2.conf<\/strong> file.<\/p>\n
      <Directory \/var\/www\/html>\r\nOptions -Indexes\r\n<\/Directory><\/pre>\n
      \"Hide<\/a><\/p>\n
      Hide Apache Directory Listing<\/p>\n<\/div>\n
      3. Keep updating Apache Regularly<\/h3>\n
      Apache developer community is continuously working on security issues<\/strong> and releasing its updated version<\/strong> with new security options<\/strong>. So It is always recommended to use the latest version<\/strong> of Apache<\/strong> as your web server.<\/p>\n
      To check Apache version<\/strong>: You can check your current version with httpd -v<\/strong> command.<\/p>\n
      # httpd -v\r\nServer version: Apache\/2.2.15 (Unix)\r\nServer built:   Aug 13 2013 17:29:28<\/pre>\n
      You can update your version with the following command.<\/p>\n
      # yum update httpd\r\n# apt-get install apache2<\/pre>\n
      It is also recommended to keep your Kernel<\/strong> and OS<\/strong> updated to the latest stable releases if you are not running any specific application which works only on specific OS or Kernel.<\/p>\n
      4. Disable Unnecessary Modules<\/h3>\n
      It\u2019s always good to minor the chances of being a victim of any web attack<\/strong>. So it\u2019s recommended to disable all those modules<\/strong> that are not in use currently. You can list all the compiled modules of web server, using following command.<\/p>\n
      # grep LoadModule \/etc\/httpd\/conf\/httpd.conf\r\n# have to place corresponding `LoadModule' lines at this location so the\r\n# LoadModule foo_module modules\/mod_foo.so\r\nLoadModule auth_basic_module modules\/mod_auth_basic.so\r\nLoadModule auth_digest_module modules\/mod_auth_digest.so\r\nLoadModule authn_file_module modules\/mod_authn_file.so\r\nLoadModule authn_alias_module modules\/mod_authn_alias.so\r\nLoadModule authn_anon_module modules\/mod_authn_anon.so\r\nLoadModule authn_dbm_module modules\/mod_authn_dbm.so\r\nLoadModule authn_default_module modules\/mod_authn_default.so\r\nLoadModule authz_host_module modules\/mod_authz_host.so\r\nLoadModule authz_user_module modules\/mod_authz_user.so\r\nLoadModule authz_owner_module modules\/mod_authz_owner.so\r\nLoadModule authz_groupfile_module modules\/mod_authz_groupfile.so\r\nLoadModule authz_dbm_module modules\/mod_authz_dbm.so\r\nLoadModule authz_default_module modules\/mod_authz_default.so\r\nLoadModule ldap_module modules\/mod_ldap.so\r\nLoadModule authnz_ldap_module modules\/mod_authnz_ldap.so\r\nLoadModule include_module modules\/mod_include.so\r\nLoadModule log_config_module modules\/mod_log_config.so\r\nLoadModule logio_module modules\/mod_logio.so\r\nLoadModule env_module modules\/mod_env.so\r\nLoadModule ext_filter_module modules\/mod_ext_filter.so\r\n....<\/pre>\n
      Above is the list of modules that are enabled by default but often not needed: mod_imap<\/strong>, mod_include<\/strong>, mod_info<\/strong>, mod_userdir<\/strong>, mod_autoindex<\/strong>. To disable the particular module, you can insert a \u201c#<\/strong>\u201d at the beginning of that line and restart the service.<\/p>\n
      5. Run Apache as separate User and Group<\/h3>\n
      With a default installation Apache<\/strong> runs its process with user nobody<\/strong> or daemon<\/strong>. For security reasons it is recommended to run Apache<\/strong> in its own non-privileged<\/strong> account. For example: http-web<\/strong>.<\/p>\n
      Create Apache User and Group<\/h5>\n
      # groupadd http-web\r\n# useradd -d \/var\/www\/ -g http-web -s \/bin\/nologin http-web<\/pre>\n
      Now you need to tell Apache<\/strong> to run with this new user and to do so, we need to make an entry in \/etc\/httpd\/conf\/httpd.conf<\/strong> and restart the service.<\/p>\n
      Open \/etc\/httpd\/conf\/httpd.conf<\/strong> with vim editor and search for keyword \u201cUser<\/strong>\u201d and \u201cGroup<\/strong>\u201d and there you will need to specify the username<\/strong> and groupname<\/strong> to use.<\/p>\n
      User http-web\r\nGroup http-web<\/pre>\n
      6. Use Allow and Deny to Restrict access to Directories<\/h3>\n
      We can restrict access to directories with \u201cAllow<\/strong>\u201d and \u201cDeny<\/strong>\u201d options in httpd.conf<\/strong> file. Here in this example, we\u2019ll be securing root directory<\/strong>, for that by setting the following in the httpd.conf<\/strong> file.<\/p>\n
      <Directory \/>\r\nOptions None\r\nOrder deny,allow\r\nDeny from all\r\n<\/Directory><\/pre>\n
        \n
      1. Options \u201cNone\u201d<\/strong> \u2013 This option will not allow users to enable any optional features.<\/li>\n
      2. Order deny, allow<\/strong> \u2013 This is the order in which the \u201cDeny<\/strong>\u201d and \u201cAllow<\/strong>\u201d directives will be processed. Here it will \u201cdeny<\/strong>\u201d first and \u201callow<\/strong>\u201d next.<\/li>\n
      3. Deny from all<\/strong> \u2013 This will deny request from everybody to the root directory<\/strong>, nobody will be able to access root directory.<\/li>\n<\/ol>\n
        7. Use mod_security and mod_evasive Modules to Secure Apache<\/h3>\n
        These two modules \u201cmod_security<\/strong>\u201d and \u201cmod_evasive<\/strong>\u201d are very popular modules of Apache in terms of security.<\/p>\n
        Mod_security<\/h4>\n
        Where mod_security<\/strong> works as a firewall<\/strong> for our web applications and allows us to monitor traffic<\/strong> on a real time basis. It also helps us to protect our websites or web server from brute force attacks<\/strong>. You can simply install mod_security<\/strong> on your server with the help of your default package installers.<\/p>\n
        Install mod_security on Ubuntu\/Debian<\/h5>\n
        $ sudo apt-get install libapache2-modsecurity\r\n$ sudo a2enmod mod-security\r\n$ sudo \/etc\/init.d\/apache2 force-reload<\/pre>\n
        Install mod_security on RHEL\/CentOS\/Fedora\/<\/h5>\n
        # yum install mod_security\r\n# \/etc\/init.d\/httpd restart<\/pre>\n
        Mod_evasive<\/h5>\n
        mod_evasive<\/strong> works very efficiently, it takes one request to process and processes it very well. It prevents DDOS attacks<\/strong> from doing as much damage. This feature of mod_evasive<\/strong> enables it to handle the HTTP brute force<\/strong>and Dos<\/strong> or DDos<\/strong> attack. This module detects attacks with three methods.<\/p>\n
          \n
        1. If so many requests come to a same page in a few times per second.<\/li>\n
        2. If any child process trying to make more than 50<\/strong> concurrent requests.<\/li>\n
        3. If any IP<\/strong> still trying to make new requests when its temporarily blacklisted<\/strong>.<\/li>\n<\/ol>\n
          mod_evasive<\/strong> can be installed directly from the source. Here, we have an Installation and setup guide of these modules which will help you to set up these Apache modules in your Linux box.<\/p>\n
            \n
          1. Protect Apache using Mod_Security and Mod_evasive<\/a><\/li>\n<\/ol>\n
            8. Disable Apache\u2019s following of Symbolic Links<\/h3>\n
            By default Apache<\/strong> follows symlinks<\/strong>, we can turn off<\/strong> this feature with FollowSymLinks<\/strong> with Options directive<\/strong>. And to do so we need to make the following entry in main configuration file.<\/p>\n
            Options -FollowSymLinks<\/pre>\n
            And, if any particular user<\/strong> or website<\/strong> need FollowSymLinks<\/strong> enable, we can simply write a rule in \u201c.htaccess<\/strong>\u201d file from that website.<\/p>\n
            # Enable symbolic links\r\nOptions +FollowSymLinks<\/pre>\n
            Note:<\/strong> To enable rewrite rules inside \u201c.htaccess<\/strong>\u201d file \u201cAllowOverride All<\/strong>\u201d should be present in the main configuration globally.<\/p>\n
            9. Turn off Server Side Includes and CGI Execution<\/h3>\n
            We can turn off<\/strong> server side includes (mod_include<\/strong>) and CGI<\/strong> execution if not needed and to do so we need to modify main configuration file.<\/p>\n
            Options -Includes\r\nOptions -ExecCGI<\/pre>\n
            We can do this for a particular directory too with Directory tag. Here In this example, we are turning off<\/strong> Includes and Cgi file executions for \u201c\/var\/www\/html\/web1<\/strong>\u201d directory.<\/p>\n
            <Directory \"\/var\/www\/html\/web1\">\r\nOptions -Includes -ExecCGI\r\n<\/Directory><\/pre>\n
            Here are some other values with can be turned On<\/strong> or off<\/strong> with Options directive.<\/p>\n
              \n
            1. Options All<\/strong> \u2013 To enable All options at once. This is the default value, If you don\u2019t want specify any values explicitly in Apache conf file or .htaccess.<\/li>\n
            2. Options IncludesNOEXEC<\/strong> \u2013 This option allows server side includes without the execute permission to a command or cgi files.<\/li>\n
            3. Options MultiViews<\/strong> \u2013 Allows content negotiated multiviews with mod_negotiation module.<\/li>\n
            4. Options SymLinksIfOwnerMatch<\/strong> \u2013 It\u2019s similar to FollowSymLinks. But, this will follow only when the owner is the same between the link and the original directory to which it is linked.<\/li>\n<\/ol>\n
              10. Limit Request Size<\/h3>\n
              By default Apache<\/strong> has no limit on the total size of the HTTP request i.e. unlimited and when you allow large requests on a web server its possible that you could be a victim of Denial of service attacks<\/strong>. We can Limit the requests size of an Apache directive \u201cLimitRequestBody<\/strong>\u201d with the directory tag.<\/p>\n
              You can set the value in bytes from 0<\/strong> (unlimited<\/strong>) to 2147483647<\/strong> (2GB<\/strong>) that are allowed in a request body. You can set this limit according to your site needs, Suppose you have a site where you allows uploads and you want to limit the upload size for a particular directory.<\/p>\n
              Here in this example, user_uploads<\/strong> is a directory which contains files uploaded by users. We are putting a limit of 500K<\/strong> for this.<\/p>\n
              <Directory \"\/var\/www\/myweb1\/user_uploads\">\r\nLimitRequestBody 512000\r\n<\/Directory><\/pre>\n
              11. Protect DDOS attacks and Hardening<\/h3>\n
              Well, it\u2019s true that you cannot completely protect your web site from DDos attacks<\/strong>. Here are some directives which can help you to have a control on it.<\/p>\n
                \n
              1. TimeOut<\/strong> : This directive allows you to set the amount of time the server will wait for certain events to complete before it fails. Its default value is 300 secs<\/strong>. It\u2019s good to keep this value low on those sites which are subject to DDOS attacks<\/strong>. This value totally depends on kind of request you are getting on your website. Note<\/strong>: It could pose problems with come CGI<\/strong> scripts.<\/li>\n
              2. MaxClients<\/strong> : This directive allows you to set the limit on connections that will be served simultaneously. Every new connection will be queued up after this limit. It is available with Prefork<\/strong> and Worker<\/strong> both MPM<\/strong>. The default value of it is 256<\/strong>.<\/li>\n
              3. KeepAliveTimeout<\/strong> : Its the amount of time the server will wait for a subsequent request before closing the connection. Default value is 5 secs<\/strong>.<\/li>\n
              4. LimitRequestFields<\/strong> : It helps us to set a limit on the number of HTTP request\u2019s header fields that will be accepted from the clients. Its default value is 100<\/strong>. It is recommended to lower this value if DDos attacks<\/strong> are occurring as a result of so many http request headers.<\/li>\n
              5. LimitRequestFieldSize<\/strong> : It helps us to set a size limit on the HTTP Request header.<\/li>\n<\/ol>\n
                12. Enable Apache Logging<\/h3>\n
                Apache allows you to logging independently of your OS logging<\/strong>. It is wise to enable Apache logging, because it provides more information, such as the commands entered by users that have interacted with your Web server.<\/p>\n
                To do so you need to include the mod_log_config<\/strong> module. There are three main logging-related directives available with Apache.<\/p>\n
                  \n
                1. TransferLog<\/strong>: Creating a log file.<\/li>\n
                2. LogFormat<\/strong> : Specifying a custom format.<\/li>\n
                3. CustomLog<\/strong> : Creating and formatting a log file.<\/li>\n<\/ol>\n
                  You can also use them for a particular website it you are doing Virtual hosting<\/strong> and for that you need to specify it in the virtual host section. For example, here is the my website virtual host configuration with logging enabled.<\/p>\n
                  <VirtualHost *:80>\r\nDocumentRoot \/var\/www\/html\/example.com\/\r\nServerName www.example.com\r\nDirectoryIndex index.htm index.html index.php\r\nServerAlias example.com\r\nErrorDocument 404 \/story.php\r\nErrorLog \/var\/log\/httpd\/example.com_error_log<\/strong>\r\nCustomLog \/var\/log\/httpd\/example.com_access_log combined<\/strong>\r\n<\/VirtualHost><\/pre>\n
                  13. Securing Apache with SSL Certificates<\/h3>\n
                  Last, but not the least SSL certificates<\/strong>, you can secure your all the communication in an encrypted manner over the Internet with SSL certificate. Suppose you have a website in which people login by proving their Login credentials or you have an E- Commerce website where people provides their bank details<\/strong> or Debit<\/strong>\/Credit<\/strong> card details to purchase products, by default your web server send these details in plain \u2013 text format but when you use SSL certificates<\/strong> to your websites, Apache<\/strong> sends all this information in encrypted text.<\/p>\n
                  You can purchase SSl certificates<\/strong> from So many different SSL providers like namecheap.com<\/strong>. If you are running a very small web business and do not willing to purchase an SSL certificate<\/strong> you can still assign a Self signed certificate<\/strong> to your website. Apache<\/strong> uses the mod_ssl<\/strong> module to support SSL certificate<\/strong>.<\/p>\n
                  # openssl genrsa -des3 -out example.com.key 1024\r\n# openssl req -new -key example.com.key -out exmaple.csr\r\n# openssl x509 -req -days 365 -in example.com.com.csr -signkey example.com.com.key -out example.com.com.crt<\/pre>\n
                  Once your certificate has been created and signed. Now you need to add this in Apache configuration. Open main configuration file with vim editor and add the following lines and restart the service.<\/p>\n
                  <VirtualHost 172.16.25.125:443>\r\nSSLEngine on\r\nSSLCertificateFile \/etc\/pki\/tls\/certs\/example.com.crt\r\nSSLCertificateKeyFile \/etc\/pki\/tls\/certs\/example.com.key\r\nSSLCertificateChainFile \/etc\/pki\/tls\/certs\/sf_bundle.crt\r\nServerAdmin ravi.saive@example.com\r\nServerName example.com\r\nDocumentRoot \/var\/www\/html\/example\/\r\nErrorLog \/var\/log\/httpd\/example.com-error_log\r\nCustomLog \/var\/log\/httpd\/example.com-access_log common\r\n<\/VirtualHost><\/pre>\n
                  Open up your browser, type https:\/\/example.com<\/strong>, and you will be able to see the new self-signed certificate<\/strong>.<\/p>\n
                  These are few security tips that you can use to secure your Apache web server<\/strong> installation. For more useful security tips and ideas, see the official online documentation of Apache HTTP Server<\/a>.<\/p>\n
                   <\/p>\n
                  source:\u00a0http:\/\/www.tecmint.com\/apache-security-tips\/<\/p>\n","protected":false},"excerpt":{"rendered":"
                  We all are very familiar with Apache web server, it is a very popular web server to host your web files or your website on the web. Here are some links which can help you to configure Apache web server on your Linux box. Apache Security and Hardening Tips Install Apache Web Server Setup Your\u2026 Read More »<\/a><\/span><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-766","post","type-post","status-publish","format-standard","hentry","category-apache"],"_links":{"self":[{"href":"https:\/\/adriangrigoras.com\/blog\/wp-json\/wp\/v2\/posts\/766","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/adriangrigoras.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/adriangrigoras.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/adriangrigoras.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/adriangrigoras.com\/blog\/wp-json\/wp\/v2\/comments?post=766"}],"version-history":[{"count":1,"href":"https:\/\/adriangrigoras.com\/blog\/wp-json\/wp\/v2\/posts\/766\/revisions"}],"predecessor-version":[{"id":767,"href":"https:\/\/adriangrigoras.com\/blog\/wp-json\/wp\/v2\/posts\/766\/revisions\/767"}],"wp:attachment":[{"href":"https:\/\/adriangrigoras.com\/blog\/wp-json\/wp\/v2\/media?parent=766"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/adriangrigoras.com\/blog\/wp-json\/wp\/v2\/categories?post=766"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/adriangrigoras.com\/blog\/wp-json\/wp\/v2\/tags?post=766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}