97a9a944b5887e91042b019776c41d5dd74557aferikabele<?xml version="1.0" encoding="UTF-8" ?>

97a9a944b5887e91042b019776c41d5dd74557aferikabele<!DOCTYPE manualpage SYSTEM "/style/manualpage.dtd">

97a9a944b5887e91042b019776c41d5dd74557aferikabele<?xml-stylesheet type="text/xsl" href="/style/manual.en.xsl"?>

a945f35eff8b6a88009ce73de6d4c862ce58de3cslive

a945f35eff8b6a88009ce73de6d4c862ce58de3cslive<manualpage>

a945f35eff8b6a88009ce73de6d4c862ce58de3cslive <relativepath href=".." />

5a58787efeb02a1c3f06569d019ad81fd2efa06end

5a58787efeb02a1c3f06569d019ad81fd2efa06end <title>Security Tips</title>

5a58787efeb02a1c3f06569d019ad81fd2efa06end

5a58787efeb02a1c3f06569d019ad81fd2efa06end <summary>

5a58787efeb02a1c3f06569d019ad81fd2efa06end <p>Some hints and tips on security issues in setting up a web server.

5a58787efeb02a1c3f06569d019ad81fd2efa06end Some of the suggestions will be general, others specific to Apache.</p>

5a58787efeb02a1c3f06569d019ad81fd2efa06end </summary>

5a58787efeb02a1c3f06569d019ad81fd2efa06end

5a58787efeb02a1c3f06569d019ad81fd2efa06end <section id="serverroot">

5a58787efeb02a1c3f06569d019ad81fd2efa06end

5a58787efeb02a1c3f06569d019ad81fd2efa06end <title>Permissions on ServerRoot Directories</title>

5a58787efeb02a1c3f06569d019ad81fd2efa06end

5a58787efeb02a1c3f06569d019ad81fd2efa06end <p>In typical operation, Apache is started by the root user, and it

5a58787efeb02a1c3f06569d019ad81fd2efa06end switches to the user defined by the <directive

5a58787efeb02a1c3f06569d019ad81fd2efa06end module="mpm_common">User</directive> directive to serve hits. As is the

a63f0ab647ad2ab72efc9bea7a66e24e9ebc5cc2nd case with any command that root executes, you must take care that it is

3b3b7fc78d1f5bfc2769903375050048ff41ff26nd protected from modification by non-root users. Not only must the files

ad74a0524a06bfe11b7de9e3b4ce7233ab3bd3f7nd themselves be writeable only by root, but so must the directories, and

ad74a0524a06bfe11b7de9e3b4ce7233ab3bd3f7nd parents of all directories. For example, if you choose to place

ad74a0524a06bfe11b7de9e3b4ce7233ab3bd3f7nd ServerRoot in /usr/local/apache then it is suggested that you create

3b3b7fc78d1f5bfc2769903375050048ff41ff26nd that directory as root, with commands like these:</p>

5a58787efeb02a1c3f06569d019ad81fd2efa06end

5a58787efeb02a1c3f06569d019ad81fd2efa06end <example>

5a58787efeb02a1c3f06569d019ad81fd2efa06end mkdir /usr/local/apache <br />

5a58787efeb02a1c3f06569d019ad81fd2efa06end cd /usr/local/apache <br />

5a58787efeb02a1c3f06569d019ad81fd2efa06end mkdir bin conf logs <br />

5a58787efeb02a1c3f06569d019ad81fd2efa06end chown 0 . bin conf logs <br />

5a58787efeb02a1c3f06569d019ad81fd2efa06end chgrp 0 . bin conf logs <br />

06ba4a61654b3763ad65f52283832ebf058fdf1cslive chmod 755 . bin conf logs

9b6a3a558cc90ffdaa0b50bd02546ffec424ded7slive </example>

9b6a3a558cc90ffdaa0b50bd02546ffec424ded7slive

9b6a3a558cc90ffdaa0b50bd02546ffec424ded7slive <p>It is assumed that /, /usr, and /usr/local are only modifiable by

9b6a3a558cc90ffdaa0b50bd02546ffec424ded7slive root. When you install the httpd executable, you should ensure that

9b6a3a558cc90ffdaa0b50bd02546ffec424ded7slive it is similarly protected:</p>

9b6a3a558cc90ffdaa0b50bd02546ffec424ded7slive

9b6a3a558cc90ffdaa0b50bd02546ffec424ded7slive <example>

97a9a944b5887e91042b019776c41d5dd74557aferikabele cp httpd /usr/local/apache/bin <br />

f8396ed8364b56ec8adeaa49cac35a929758a29eslive chown 0 /usr/local/apache/bin/httpd <br />

97a9a944b5887e91042b019776c41d5dd74557aferikabele chgrp 0 /usr/local/apache/bin/httpd <br />

f8396ed8364b56ec8adeaa49cac35a929758a29eslive chmod 511 /usr/local/apache/bin/httpd

f8396ed8364b56ec8adeaa49cac35a929758a29eslive </example>

5a58787efeb02a1c3f06569d019ad81fd2efa06end

5a58787efeb02a1c3f06569d019ad81fd2efa06end <p>You can create an htdocs subdirectory which is modifiable by other

5a58787efeb02a1c3f06569d019ad81fd2efa06end users -- since root never executes any files out of there, and shouldn't

a63f0ab647ad2ab72efc9bea7a66e24e9ebc5cc2nd be creating files in there.</p>

5a58787efeb02a1c3f06569d019ad81fd2efa06end

117c1f888a14e73cdd821dc6c23eb0411144a41cnd <p>If you allow non-root users to modify any files that root either

117c1f888a14e73cdd821dc6c23eb0411144a41cnd executes or writes on then you open your system to root compromises.

117c1f888a14e73cdd821dc6c23eb0411144a41cnd For example, someone could replace the httpd binary so that the next

117c1f888a14e73cdd821dc6c23eb0411144a41cnd time you start it, it will execute some arbitrary code. If the logs

117c1f888a14e73cdd821dc6c23eb0411144a41cnd directory is writeable (by a non-root user), someone could replace

117c1f888a14e73cdd821dc6c23eb0411144a41cnd a log file with a symlink to some other system file, and then root

117c1f888a14e73cdd821dc6c23eb0411144a41cnd might overwrite that file with arbitrary data. If the log files

117c1f888a14e73cdd821dc6c23eb0411144a41cnd themselves are writeable (by a non-root user), then someone may be

117c1f888a14e73cdd821dc6c23eb0411144a41cnd able to overwrite the log itself with bogus data.</p>

117c1f888a14e73cdd821dc6c23eb0411144a41cnd

117c1f888a14e73cdd821dc6c23eb0411144a41cnd </section>

117c1f888a14e73cdd821dc6c23eb0411144a41cnd

117c1f888a14e73cdd821dc6c23eb0411144a41cnd <section id="ssi">

117c1f888a14e73cdd821dc6c23eb0411144a41cnd

117c1f888a14e73cdd821dc6c23eb0411144a41cnd <title>Server Side Includes</title>

117c1f888a14e73cdd821dc6c23eb0411144a41cnd

117c1f888a14e73cdd821dc6c23eb0411144a41cnd <p>Server Side Includes (SSI) present a server administrator with

5a58787efeb02a1c3f06569d019ad81fd2efa06end several potential security risks.</p>

5a58787efeb02a1c3f06569d019ad81fd2efa06end

5a58787efeb02a1c3f06569d019ad81fd2efa06end <p>The first risk is the increased load on the server. All

5a58787efeb02a1c3f06569d019ad81fd2efa06end SSI-enabled files have to be parsed by Apache, whether or not

5a58787efeb02a1c3f06569d019ad81fd2efa06end there are any SSI directives included within the files. While this

5a58787efeb02a1c3f06569d019ad81fd2efa06end load increase is minor, in a shared server environment it can become

a63f0ab647ad2ab72efc9bea7a66e24e9ebc5cc2nd significant.</p>

a63f0ab647ad2ab72efc9bea7a66e24e9ebc5cc2nd

5a58787efeb02a1c3f06569d019ad81fd2efa06end <p>SSI files also pose the same risks that are associated with CGI

5a58787efeb02a1c3f06569d019ad81fd2efa06end scripts in general. Using the "exec cmd" element, SSI-enabled files

5a58787efeb02a1c3f06569d019ad81fd2efa06end can execute any CGI script or program under the permissions of the

5a58787efeb02a1c3f06569d019ad81fd2efa06end user and group Apache runs as, as configured in httpd.conf.</p>

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick <p>There are ways to enhance the security of SSI files while still

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick taking advantage of the benefits they provide.</p>

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick <p>To isolate the damage a wayward SSI file can cause, a server

06ba4a61654b3763ad65f52283832ebf058fdf1cslive administrator can enable <a href="/suexec.html">suexec</a> as

ea8a727ff298d2f5368b55b7ae8d87091ae106e7nd described in the <a href="#cgi">CGI in General</a> section</p>

06ba4a61654b3763ad65f52283832ebf058fdf1cslive

06ba4a61654b3763ad65f52283832ebf058fdf1cslive <p>Enabling SSI for files with .html or .htm extensions can be

06ba4a61654b3763ad65f52283832ebf058fdf1cslive dangerous. This is especially true in a shared, or high traffic,

92510838f2eb125726e15c5eb4f7a23c7a0396e4slive server environment. SSI-enabled files should have a separate extension,

97a9a944b5887e91042b019776c41d5dd74557aferikabele such as the conventional .shtml. This helps keep server load at a

92510838f2eb125726e15c5eb4f7a23c7a0396e4slive minimum and allows for easier management of risk.</p>

92510838f2eb125726e15c5eb4f7a23c7a0396e4slive

97a9a944b5887e91042b019776c41d5dd74557aferikabele <p>Another solution is to disable the ability to run scripts and

9b6a3a558cc90ffdaa0b50bd02546ffec424ded7slive programs from SSI pages. To do this replace <code>Includes</code>

9b6a3a558cc90ffdaa0b50bd02546ffec424ded7slive with <code>IncludesNOEXEC</code> in the <directive

92510838f2eb125726e15c5eb4f7a23c7a0396e4slive module="core">Options</directive> directive. Note that users may

92510838f2eb125726e15c5eb4f7a23c7a0396e4slive still use &gt;--#include virtual="..." --&lt; to execute CGI scripts if

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick these scripts are in directories desginated by a <directive

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick module="mod_alias">ScriptAlias</directive> directive.</p>

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick </section>

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick <section id="cgi">

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick <title>CGI in General</title>

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick <p>First of all, you always have to remember that you must trust the

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick writers of the CGI scripts/programs or your ability to spot potential

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick security holes in CGI, whether they were deliberate or accidental. CGI

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick scripts can run essentially arbitrary commands on your system with the

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick permissions of the web server user and can therefore be extremely

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick dangerous if they are not carefully checked.</p>

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick <p>All the CGI scripts will run as the same user, so they have potential

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick to conflict (accidentally or deliberately) with other scripts e.g. User

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick A hates User B, so he writes a script to trash User B's CGI database. One

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick program which can be used to allow scripts to run as different users is

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick <a href="/suexec.html">suEXEC</a> which is included with Apache as of

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick 1.2 and is called from special hooks in the Apache server code. Another

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick popular way of doing this is with

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick <a href="http://cgiwrap.unixtools.org/">CGIWrap</a>.</p>

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick </section>

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick <section id="nsaliasedcgi">

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick <title>Non Script Aliased CGI</title>

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick <p>Allowing users to execute CGI scripts in any directory should only be

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick considered if;</p>

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick <ul>

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick <li>You trust your users not to write scripts which will deliberately

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick or accidentally expose your system to an attack.</li>

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick <li>You consider security at your site to be so feeble in other areas,

92510838f2eb125726e15c5eb4f7a23c7a0396e4slive as to make one more potential hole irrelevant.</li>

92510838f2eb125726e15c5eb4f7a23c7a0396e4slive <li>You have no users, and nobody ever visits your server.</li>

97a9a944b5887e91042b019776c41d5dd74557aferikabele </ul>

92510838f2eb125726e15c5eb4f7a23c7a0396e4slive

ea8a727ff298d2f5368b55b7ae8d87091ae106e7nd </section>

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick

ea8a727ff298d2f5368b55b7ae8d87091ae106e7nd <section id="saliasedcgi">

ea8a727ff298d2f5368b55b7ae8d87091ae106e7nd

ea8a727ff298d2f5368b55b7ae8d87091ae106e7nd <title>Script Aliased CGI</title>

ea8a727ff298d2f5368b55b7ae8d87091ae106e7nd

8a6d5edcb07aeccca7afba02a17dd6904d6b206ctrawick <p>Limiting CGI to special directories gives the admin control over what

ea8a727ff298d2f5368b55b7ae8d87091ae106e7nd goes into those directories. This is inevitably more secure than non

06ba4a61654b3763ad65f52283832ebf058fdf1cslive script aliased CGI, but only if users with write access to the

e8d485701957d5c6de870111c112e168a894d49and directories are trusted or the admin is willing to test each

e8d485701957d5c6de870111c112e168a894d49and new CGI script/program for potential security holes.</p>

e8d485701957d5c6de870111c112e168a894d49and

9b6a3a558cc90ffdaa0b50bd02546ffec424ded7slive <p>Most sites choose this option over the non script aliased CGI

9b6a3a558cc90ffdaa0b50bd02546ffec424ded7slive approach.</p>

9b6a3a558cc90ffdaa0b50bd02546ffec424ded7slive

9b6a3a558cc90ffdaa0b50bd02546ffec424ded7slive </section>

9b6a3a558cc90ffdaa0b50bd02546ffec424ded7slive

9b6a3a558cc90ffdaa0b50bd02546ffec424ded7slive <section id="dynamic">

06ba4a61654b3763ad65f52283832ebf058fdf1cslive

97a9a944b5887e91042b019776c41d5dd74557aferikabele <title>Other sources of dynamic content</title>

9b6a3a558cc90ffdaa0b50bd02546ffec424ded7slive

9b6a3a558cc90ffdaa0b50bd02546ffec424ded7slive <p>

5a58787efeb02a1c3f06569d019ad81fd2efa06end Embedded scripting options which run as part of the server itself,

5a58787efeb02a1c3f06569d019ad81fd2efa06end such as mod_php, mod_perl, mod_tcl, and mod_python, run under the

3b3b7fc78d1f5bfc2769903375050048ff41ff26nd identity of the server itself (see the <directive

ad74a0524a06bfe11b7de9e3b4ce7233ab3bd3f7nd module="mpm_common">User</directive> directive), and therefore

ad74a0524a06bfe11b7de9e3b4ce7233ab3bd3f7nd scripts executed by these engines potentially can access anything the

ad74a0524a06bfe11b7de9e3b4ce7233ab3bd3f7nd server user can. Some scripting engines may provide restrictions, but

3b3b7fc78d1f5bfc2769903375050048ff41ff26nd it is better to be safe and assume not.</p>

5a58787efeb02a1c3f06569d019ad81fd2efa06end

5a58787efeb02a1c3f06569d019ad81fd2efa06end </section>

5a58787efeb02a1c3f06569d019ad81fd2efa06end

<section id="systemsettings">

<title>Protecting System Settings</title>

<p>To run a really tight ship, you'll want to stop users from setting

up <code>.htaccess</code> files which can override security features

you've configured. Here's one way to do it.</p>

<p>In the server configuration file, put</p>

<example>

&lt;Directory /&gt; <br />

AllowOverride None <br />

&lt;/Directory&gt;

</example>

<p>This prevents the use of <code>.htaccess</code> files in all

directories apart from those specifically enabled.</p>

</section>

<section id="protectserverfiles">

<title>Protect Server Files by Default</title>

<p>One aspect of Apache which is occasionally misunderstood is the

feature of default access. That is, unless you take steps to change it,

if the server can find its way to a file through normal URL mapping

rules, it can serve it to clients.</p>

<p>For instance, consider the following example:</p>

<example>

# cd /; ln -s / public_html <br />

Accessing <code>http://localhost/~root/</code>

</example>

<p>This would allow clients to walk through the entire filesystem. To

work around this, add the following block to your server's

configuration:</p>

<example>

&lt;Directory /&gt; <br />

Order Deny,Allow <br />

Deny from all <br />

&lt;/Directory&gt;

</example>

<p>This will forbid default access to filesystem locations. Add

appropriate <directive module="core">Directory</directive> blocks to

allow access only in those areas you wish. For example,</p>

<example>

&lt;Directory /usr/users/*/public_html&gt; <br />

Order Deny,Allow <br />

Allow from all <br />

&lt;/Directory&gt; <br />

&lt;Directory /usr/local/httpd&gt; <br />

Order Deny,Allow <br />

Allow from all <br />

&lt;/Directory&gt;

</example>

<p>Pay particular attention to the interactions of <directive

module="core">Location</directive> and <directive

module="core">Directory</directive> directives; for instance, even

if <code>&lt;Directory /&gt;</code> denies access, a <code>

&lt;Location /&gt;</code> directive might overturn it</p>

<p>Also be wary of playing games with the <directive

module="mod_userdir">UserDir</directive> directive; setting it to

something like "./" would have the same effect, for root, as the first

example above. If you are using Apache 1.3 or above, we strongly

recommend that you include the following line in your server

configuration files:</p>

<example>

UserDir disabled root

</example>

</section>

<section id="watchyourlogs">

<title>Watching Your Logs</title>

<p>To keep up-to-date with what is actually going on against your server

you have to check the <a href="/logs.html">Log Files</a>. Even though

the log files only reports what has already happend, they will give you

some understanding of what attacks is thrown against the server and

allows you to check if the necessary level of security is present.</p>

<p>A couple of examples:</p>

<example>

grep -c "/jsp/source.jsp?/jsp/ /jsp/source.jsp??" access_log <br />

grep "client denied" error_log | tail -n 10

</example>

<p>The first example will list the number of attacks trying to exploit the

<a href="http://online.securityfocus.com/bid/4876/info/">Apache Tomcat

Source.JSP Malformed Request Information Disclosure Vulnerability</a>,

the second example will list the ten last denied clients, for example:</p>

<example>

[Thu Jul 11 17:18:39 2002] [error] [client foo.bar.com] client denied

by server configuration: /usr/local/apache/htdocs/.htpasswd

</example>

<p>As you can see, the log files only report what already has happend, so

if the client had been able to access the <code>.htpasswd</code> file you

would have seen something similar to:</p>

<example>

foo.bar.com - - [12/Jul/2002:01:59:13 +0200] "GET /.htpasswd HTTP/1.1"

</example>

<p>in your <a href="/logs.html#accesslog">Access Log</a>. This means

you probably commented out the following in your server configuration

file:</p>

<example>

&lt;Files ~ "^\.ht"&gt; <br />

Order allow,deny <br />

Deny from all <br />

&lt;Files&gt;

</example>

</section>

</manualpage>