Security

Ask something
Discussion Locked

DOWNLOAD: Apache Web Server: Lock it down in 10 steps

0 helpful
3 replies

by jasonhiner

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

.
https://www.techrepublic.com.com/5138-10595-5697982.html

After you take a look at this video, please post your feedback, ideas for future improvements, or further thoughts on this topic.

Thanks,
TechRepublic Downloads Team

3 replies

by thomas_nooning

I'd be interested in hearing what you other SysAdmins out there have done to harden Apache. And please let me know if you have any questions regarding the steps outlined in the download.

Thanks, Tom

by jaqui

are the default configuration options of all the linux distros I've looked at.
also the recommended config from apache.org.

I would add:
install the bandwidth module, which kills the iis specific viruses that consume data transfer by reporting infected machines to one location.

disable any cgi but approved scripts.
do not enable frontpage extentions ( they break security by accessing activex controls )

force download and saving of any file other than html/xhtml/php/xml
( do default opening of pdf )

use moz_gzip
compress all data being transferred, saves data transfer, and stops execution of malicious code until user enables.

by thomas_nooning

While some of the items listed are indeed part of the default configuration on many distributions, not all of them are. I've yet to come across one that installs Apache into a chroot jail for instance, well maybe Tinfoil Hat Linux. But leaving it up to the defaults is not the best idea on any production webserver, you should know the best practices by heart.

And mod_gzip is nice, but be careful with browser compatility and certain file types, like CSS and JavaScript.

This discussion is closed to new replies.