topic Re: How to make Apache more secure in Operating System - Linux

How to make Apache more secure

Girish_26 — Fri, 13 May 2005 00:17:12 GMT

Does any one of you have idea of hardening Apache and making more secure to outside world....somebody told u have standard CIS Bemchmark for this....can u check and let me know....

Re: How to make Apache more secure

Stuart Browne — Fri, 13 May 2005 03:57:49 GMT

In what area are you wanting to make it more secure?

Running it in a CHRoot jail so there's no other filesystem info available?

Tieing down the HTML documents so they are more restrictive?

Limiting access to CGI's and other dynamic content?

As for the CIS Benchmark thing, I've never heard of it.

Re: How to make Apache more secure

Naveej.K.A — Fri, 13 May 2005 04:35:33 GMT

Girish,

Download the CIS benchmarking tool from here

http://www.cisecurity.org/sub_form.html

The Download Files Include

Apache_Benchmark_v1.0.pdf - the Benchmark document contains detailed instructions for implementing the steps necessary for CIS Level-1 and Level-2 security.>

cis_score_tool_apache_v2.0.8.sh.gz - a Host-based Scoring Tool scores the security of a system against the Benchmark and creates a variance report.

Regards,
Naveej

Re: How to make Apache more secure

Stuart Browne — Fri, 13 May 2005 10:46:44 GMT

Well that document sounds like simple common sense to me, but I guess I've been doing this sort of thing for a long time.

That PDF doesn't really lay down many restrictions on what Apache should have in order to pass.

Re: How to make Apache more secure

Jan van den Ende — Mon, 16 May 2005 04:10:49 GMT

Girish,

I have of course no clue about the 'room to move' you have, but, if you still have a free choice of infrastructure, then you might consider Apache on OpenVMS.

The _ONLY_ available Apache for VMS _IS_ the Secure Web Server.

hth

Proost.

Have one on me.

jpe

Re: How to make Apache more secure

Jerome Henry — Mon, 16 May 2005 05:08:34 GMT

Hi,

Apache team guys aren't little boys, Apache is fairly safe as shipped, but it depends much on what you do with it. Have a nessus try on it, or something more sophisticated like webscarab if you need specific tests.

Security also relies much on what you put on your server... could you tell us more about it ? cgi ? Fast cgi ? perl ? php ? static ?
And son on.

Tks

Rgds

Jerome

Re: How to make Apache more secure

Gary Cantwell — Mon, 16 May 2005 10:02:13 GMT

Hi Girish,

Welcome to the forums!

please take a moment to assign points to those who have assisted you:

http://forums1.itrc.hp.com/service/forums/helptips.do?#33

thanks,

Gary