Chapter 8, pp 171 – pp 200 Web Security, by Lincoln D. Stein Unix Web Servers Chapter 8, pp 171 – pp 200 Web Security, by Lincoln D. Stein 2019/5/4 Y K Choi

Overview Hardening a Unix Web server (means make it more secure) Configuring the Web server Monitoring logs 2019/5/4 Y K Choi

Hardening a Unix Web server Unix is a multi-user system. It supports over hundreds of users with different directories and environments. A user cannot modify or read a particular resources. Users are grouped. (user: group:system) right It is a general purpose system and is insecure. That is why we need to harden a Unix. 2019/5/4 Y K Choi

Four tasks to harden Unix Apply vendor operating system When a patch appears related to security, download immediately Turn off unessential services For example, your Unix can support NT file sharing, POP, NFS, etc. and many of them might have holes, turn off them. Use netstat to find the ports that are in listening mode that are not used. If the following are not required, disable it tftp, finger, systat, uucp, exec, login, shell Remember Some of them 2019/5/4 Y K Choi

Four tasks to harden Unix Add the minimum of users accounts It is because the major sources of Internet break-ins are intruders who have obtained a valid user and password and use it to log into the server. Disable password by placing * in /etc/password (for example uucp) uucp:*:10:14:uucp:/var/spool/uucppublic: Get the right file and directory permissions right If a web file is set to write, you should be careful. 2019/5/4 Y K Choi

Access Rights for Web Server Files User Configuration Tools Logs CGI Documents Web Master RW R Web developer - Web author Web server R:read access: W: write access 2019/5/4 Y K Choi

4 groups with different access right Grouping It is secure to create four groups Webmaster Web developers Web authors HTTP users 4 groups with different access right Read only 2019/5/4 Y K Choi

Configuring the web server (1) In order to run the server as secure as possible, we will do the following: Disable unnecessary web server features (there are many features that are not used) such as the following (you should disable them) Automatic directory listings Symbolic link following:use symbolic links to extend the document tree to other pats of the file system, as it is easy to create an inadvertent link 2019/5/4 Y K Choi

Configuring the web server (2) CGI scripts and server modules: executable scripts pose a threat as they do things that the authors did not anticipate. Server side include: allows web authors to create HTML pages that change dynamically without restoring to full-blown scripts or plug-ins. Start and stop the server without using root privileges: this is to reduce the use of root account. 3 mores 2019/5/4 Y K Choi

You should review the logs to determine who has accessed your systems. Monitoring the logs Unix system logs: it keeps a series of log files and you can find them in /usr/adm Server log: The files created by Web servers are useful for tracking down problems. Most servers creates two logs: access logs and servers logs. You should review the logs to determine who has accessed your systems. 2019/5/4 Y K Choi

Web Log Tools (no need to memorise) Product Manufacturer OS Notes Analog Stephen Turner NT/Unix Freeware wusage Boutell Corp. wwstat Roy Fielding Site Tracker Tucker info. All OS Net.analysis Net.genesis NT/Solaries Don’t memorise 2019/5/4 Y K Choi

Error Logs Some of the error messages that you can find are: File does not exist: access a URL that does not exist File permissions deny server access: access a document that does not have sufficient privileges to read it. Password mismatch: access a protected document with an incorrect password Client denied by server configuration: access to a directory is restricted to certain IP addresses Malformed header from script: This is a warning message showing that a bad output cannot be interpreted correctly. 2019/5/4 Y K Choi

Summary Unix is not a perfect OS, we need to harden this by: 1) downloading the latest patch, 2) disabling unnecessary services, 3) minimizing the number of users, etc. Configure the Web server: minimise the use of privileged user, limit DOS Monitor the logs: Unix system logs, server log and error log 2019/5/4 Y K Choi