 |
 |
 |
 |
 |
 |
 |
|||||
Apache Web Server DetailsRun the Server as an Unprivileged UserThe best way to reduce your exposure to attack when running a Web server is to create a unique unprivileged userid and group for the server application. The userid and group nobody are typically used for this purpose, but a userid and group that are unique to the Web server is a better solution from a security perspective. By default the Web server uses a privileged port (port 80) and, when configured for secure operation, must have root privileges to open its log files and start the dæmon. Once the server's startup tasks are complete, all active instances can run as the unprivileged user. Use the following command line entries as patterns for creating a group and user for the Web server. Substitute the directory you intend to use for the Web server for <server root> (under Solaris 2.x, this would typically be a subdirectory of /opt (e.g. /opt/httpd). groupadd httpd To make sure the user account you created can't be used to log on, check the entry for the user in /etc/shadow. The password field should contain the entry *LK*, indicating that the account is locked and cannot be used to log in. httpd:*LK*::::::: Install the ServerBy convention, shared third-party applications are installed in the /opt directory. The root directory for a Web server, commonly referred to as the Server Root directory, would thus be a subdirectory in /opt (e.g., /opt/httpd). If you have followed our instructions for securing the host, you will have to unpack the distribution and compile it on a separate host. When you unpack the distribution file, you should see the following directories: cgi-bin To make your server more secure, use a separate disk partition for your Web content. Create a unique mount point for this directory; htdocs is a good name to use, but make it somewhere outside the ServerRoot directory. You'll need to update /etc/vfstab to mount this partition as part of your server's startup process. Do not use the htdocs directory included in the distribution as your DocumentRoot. This directory contains user documentation that you don't want to make available to the public: it contains information an attacker could use to penetrate your system. Move these documentation files into your support directory so that the Webmasters for your site can refer to them as needed. The src directory should not be installed on your server. The contents of this directory are only needed when you are compiling the dæmon executable. Set Directory and File PermissionsBackground InformationWe focus our discussion on the issues involved in setting directory and file permissions on Solaris 2.x. Throughout this guide, we will use /opt/httpd as the server's base directory (i.e., as ServerRoot). Apache (and NCSA) server software includes files grouped by function into subdirectories. The following table lists subdirectories normally located in the ServerRootdirectory:
NOTE: Because the server's log files can quickly grow in size, you may want to move this directory to another file system with adequate space. You will have to change the server's configuration to support this change. To define access privileges for the Web server and related files, we can break users into three groups. Because we want the server to run under a non-privileged userid, we define a fourth group for the server itself. These groups are based on functional roles:
The following matrix lists permissions for each directory by group role. This matrix is based in part on recommendations provided in Lincoln Stein's book, Web Security. Note that you will have to add some individuals to multiple groups to provide the required levels of access.
Making the Changes
NOTE: In his Web Security Lincoln Stein recommends using mode 2xxx (i.e. setting the SGID bit) for some server directories. His point is that this makes file and directory sharing easier for members of the groups involved in maintaining parts of the server. We followed his recommendations for the server's ScriptAlias and DocumentRoot< directories, but users' UMASKs may have to be changed to make group ownership of new files match the group ownership for the directory. Delete Unneeded CGI ScriptsDelete all CGI scripts included in your Apache distribution. Install only those CGI scripts you have tested and found safe. At least one of the commonly distributed scripts, pfh, has been used to compromise several Web servers. You should require that all CGI scripts be run only from your strictly controlled cgi-bin directory, and you should not allow not the use of shell scripts. Delete Unneeded HTML DocumentsRemove all non-essential files from the directories under the DocumentRoot directory specified in your srm.conf file. It takes only a small error to cause your server to provide a listing of the files in a directory to a browser. If you've developed the habit of leaving files in the directories within your DocumentRoot directory tree, thinking that they can't be accessed if they're not linked to some document, that one small mistake can lead to an unauthorized disclosure. A freshly installed Web server is the best time to start developing good file discipline. Configure the Server
Within the /opt/httpd/conf directory, make copies of the default configuration files distributed with for Apache/NCSA. # cd /opt/httpd/conf Make the changes specified below for each of the server configuration files to make your server work correctly. httpd.conf (Basic Server Configuration)In the table below we list server directives and suggested values. Server directives not mentioned should be left at the default values.
The following entries affect the load placed on your host machine by the Web server. The StartServers and MinSpareServers entries are closely related; if you change one, you must make the same change in the other. The default value for these parameters is five. Depending on the load you anticipate, you may want to adjust this value up or down. StartServers The following is a list of other entries in this file that can affect your server's ability to withstand a denial of service attack. You can safely leave these additional settings at the default values, but should familiarize yourself with the entries and their effect on the server: Timeout srm.conf (Directory and Document Configuration)Entries not specifically mentioned here can be safely left with default values.
The following entries in srm.conf can compromise security and should therefore be commented out. Make sure you understand the consequences if you choose to make one or more of these options active.
access.conf (Security Related Configuration)This file controls several critical security features of the Web server. NOTE: The directives in this file apply to specific items. For example, if we define /htdocs within the <Directory ...> ...</Directory> tags, we can apply access controls and other restrictions to the entire directory tree with an entry of the following form in this file: <Directory /htdocs> A complete explanation of the structure and capabilities provided through this file is way beyond the scope of this document. Please refer to the Apache User's Guide for a more complete explanation.
Configure Server AuditingBy default, log files are written to the logs subdirectory of the ServerRoot directory. You can change the log file names and locations by modifying their directives in httpd.conf. Do not disable logging. The server normally creates two log files: access_log (TransferLog) Optional LogYou can capture user agent (browser) data by adding the AgentLog directive to httpd.conf—use the other log entries as a pattern. Configure Access Control and AuthenticationThe Apache server offers a number of methods for restricting access. Capabilities range from allowing connections only from specified IP addresses or domains, to detailed user and password access control for individual files. A complete discussion of Apache's access control features is beyond the scope of this document. Please refer to the Apache User Guide for details. Access control for the server is set in the access.conf file. The primary access control for the server is specified in a <Directory...> entry covering the server's DocumentRoot. As specified by the Options field in this directive, the default is to allow the server to present index listings and to follow symbolic links in locating Web pages. Who is allowed to access the server is controlled by the order and allow fields in this same directive. By default, the whole world can access everything. To change access permissions, change the allow entry and add deny entries as required. For example, to permit access from only those clients whose IP addresses are in the class B address space 162.45.xxx.xxx you would change the default settings:
Authentication and access control are handled by the Options field in <Directory> and <Limit> directives. These directives are normally specified in the access.conf file. Use of these directives and the access control features they provide is related to the use of .htaccess files in subdirectories located in the server's DocumentRoot, but this can be changed through the use of the AllowOverride directive. Restrict Remote OperationsPermission to add files to a directory using FTP's PUT is controlled by file and directory permissions. The default configuration we specify will allow anyone in the Webauth group to FTP files into your DocumentRoot directory tree. HTTP POST is controlled using the Limit directive. Before you configure your server to allow HTTP POST operations, you should understand the use of Apache's authentication and access controls to restrict these activities to designated individuals. Provide a Security BannerUse the following as an example: ###################################################################### This system is intended for authorized users only. Activity on this system is monitored and recorded. If monitoring reveals activities exceeding privileges, attempts to penetrate system security, or possible criminal activity, system personnel may provide evidence of such activity to law enforcement officials. If you continue past this point, you consent to this monitoring. ###################################################################### Starting and Stopping the ServerThe following script is a pattern for automating the process of starting and stopping the Web server. Give this script the filename httpd and copy it to /etc/init.d, then create the soft links specified below to complete the process. #!/bin/sh Create the following links to the above script: cd /etc/rc3.d cd /etc/rc0.d Periodically Archive and Reset LogsApache stores the offset of the end of the most recent entry in its log files and will try to write the next entry at that offset in the file. So, to archive and rotate Apache's logs, you need to move the log files and restart Apache. Because access.log grows by about one megabyte for each 10,000 hits, you should do this on a regular basis. Here's a small shell script you can run from cron to move the log files, create (empty) new ones and archive the old logs. This process requires an archive subdirectory in your logs directory. We recommend clearing your logs with this procedure on a weekly basis. If you're running a program to automatically update a server statistics page, you can run this script shortly after your statistics program does its update. #!/bin/sh |
Our Publications |
