topic Re: How to build a secure web server in Operating System - Linux

How to build a secure web server

shankar! — Wed, 10 Jun 2009 10:26:11 GMT

Hi All,

We're planning to build a secure apache web server. We have gone to apache.org and downloaded latest source software (httpd-2.2.11.tar.gz). Now what else should be needed in order to make a secure server (https). This is just for a development work and users inside intranet will use it for a specific purpose.

Can someone please suggest how to do this?

Thanks

Re: How to build a secure web server

shankar! — Wed, 10 Jun 2009 10:26:55 GMT

Our OS is, RHEL 4 ES UP 2

Thanks
shankar

Re: How to build a secure web server

Michal Kapalka (mikap) — Wed, 10 Jun 2009 10:39:03 GMT

hi,

check this links :

http://tldp.org/HOWTO/SSL-RedHat-HOWTO.html#toc4

http://www.cyberciti.biz/tips/chroot-apache-under-rhel-fedora-centos-linux.html

this is a link from securityfocus :
# part1
http://www.securityfocus.com/infocus/1818
# part2
http://www.securityfocus.com/infocus/1820
# part3
http://www.securityfocus.com/infocus/1823

mikap

Re: How to build a secure web server

shankar! — Wed, 10 Jun 2009 10:59:45 GMT

Those links from "security focus" helped me a lot..

Now when I try to access the web server, I get a message like
Authenticated by CN and test only certificate. Is this because i don't have a valid SSL certificate?

Thanks

Re: How to build a secure web server

Michal Kapalka (mikap) — Wed, 10 Jun 2009 11:06:20 GMT

hi,

it could be, but if you are make a self signed certificate it could be working.

http://www.tc.umn.edu/~brams006/selfsign.html

http://www.akadia.com/services/ssh_test_certificate.html

mikap

Re: How to build a secure web server

Jared Middleton — Wed, 10 Jun 2009 22:24:02 GMT

> RHEL 4 ES UP 2

If you're interested in security, you might want to have a procedure in place to keep the system more up-to-date. RHEL 4 Update 2 is at least a couple years old. It's now at Update 8...

# cat /etc/redhat-release
Red Hat Enterprise Linux ES release 4 (Nahant Update 8)

Re: How to build a secure web server

dirk dierickx — Thu, 11 Jun 2009 05:38:28 GMT

also keep in mind that you are only securing the http server, this means nothing as you say it will be used for development.

this is where it all could go horribly wrong, it's easy to get a bug, coding error or even sloppy code on your secure web browser and then it's game over.

there are a lot of books on this topic and even some tools that can help test web based app security testing. might want to check some of those out as well.

Re: How to build a secure web server

shankar! — Thu, 11 Jun 2009 07:12:51 GMT

Thank you all.

Re: How to build a secure web server

shankar! — Thu, 11 Jun 2009 07:13:10 GMT

thanks