Apache Security

Once you've secured the Linux operating system you can begin to take care of the Apache web server.
many web server is apache,Litespeed,nginx,etc.

then How it apache security ?
here i am just write One important  for apache webserver.

To harden Apache go through these steps:

[#] Install mod_security

an Apache module that works as application firewall. It filters all parts of a web request and stops malicious code.
It is the fastest and easiest way to protect a vulnerable web application.

In order to provide generic web applications protection, the Core Rules use the following techniques:
- HTTP Protection - detecting violations of the HTTP protocol and a locally defined usage policy.
- Real-time Blacklist Lookups - utilizes 3rd Party IP Reputation
- Web-based Malware Detection - identifies malicious web content by check against the Google Safe Browsing API.
- HTTP Denial of Service Protections - defense against HTTP Flooding and Slow HTTP DoS Attacks.
- Common Web Attacks Protection - detecting common web application security attack.
- Automation Detection - Detecting bots, crawlers, scanners and other surface malicious activity.
- Integration with AV Scanning for File Uploads - detects malicious files uploaded through the web application.
- Tracking Sensitive Data - Tracks Credit Card usage and blocks leakages.
- Trojan Protection - Detecting access to Trojans horses.
- Identification of Application Defects - alerts on application misconfigurations.
- Error Detection and Hiding - Disguising error messages sent by the server.

[#] Install mod_evasive

another important Apache module that protects and detect web applications against denial of service (DOS) requests.

Detection is performed by creating an internal dynamic hash table of IP Addresses and URIs, and denying any single IP address from any of the following:
- Requesting the same page more than a few times per second
- Making more than 50 concurrent requests on the same child per second
- Making any requests while temporarily blacklisted (on a blocking list)

[#] Filter visitors' IP addresses

we can use .htaccess fileter the ip adress to access. allow and Dany ipaddress to access controller.
you can use Allow Deny or mod_rewrite in this step.

we will Post in other time for install it all.
thankz .

Posted by Unknown on Tuesday, 5 March 2013 - Rating: 4.5

Title : Apache Security
Description : Once you've secured the Linux operating system you can begin to take care of the Apache web server. many web server is apache,Litespee...

Tweet