1. Chapter 8, pp 171 – pp 200 Web Security, by Lincoln D. Stein
Unix Web Servers
Chapter 8, pp 171 – pp 200
Web Security, by Lincoln D. Stein
2019/5/4
Y K Choi

2. Overview Hardening a Unix Web server (means make it more secure)
Configuring the Web server
Monitoring logs
2019/5/4
Y K Choi

3. Hardening a Unix Web server
Unix is a multi-user system.
It supports over hundreds of users with different directories and environments.
A user cannot modify or read a particular resources.
Users are grouped. (user: group:system) right
It is a general purpose system and is insecure. That is why we need to harden a Unix.
2019/5/4
Y K Choi

4. Four tasks to harden Unix
Apply vendor operating system
When a patch appears related to security, download immediately
Turn off unessential services
For example, your Unix can support NT file sharing, POP, NFS, etc. and many of them might have holes, turn off them. Use netstat to find the ports that are in listening mode that are not used.
If the following are not required, disable it
tftp, finger, systat, uucp, exec, login, shell
Remember
Some of them
2019/5/4
Y K Choi

5. Four tasks to harden Unix
Add the minimum of users accounts
It is because the major sources of Internet break-ins are intruders who have obtained a valid user and password and use it to log into the server.
Disable password by placing * in /etc/password (for example uucp)
uucp:*:10:14:uucp:/var/spool/uucppublic:
Get the right file and directory permissions right
If a web file is set to write, you should be careful.
2019/5/4
Y K Choi

6. Access Rights for Web Server Files
User
Configuration
Tools
Logs
CGI
Documents
Web Master RW R
Web developer -
Web author
Web server
R:read access: W: write access
2019/5/4
Y K Choi

7. 4 groups with different access right
Grouping
It is secure to create four groups
Webmaster
Web developers
Web authors
HTTP users
4 groups with different access right
Read only
2019/5/4
Y K Choi

8. Configuring the web server (1)
In order to run the server as secure as possible, we will do the following:
Disable unnecessary web server features (there are many features that are not used) such as the following (you should disable them)
Automatic directory listings
Symbolic link following:use symbolic links to extend the document tree to other pats of the file system, as it is easy to create an inadvertent link
2019/5/4
Y K Choi

9. Configuring the web server (2)
CGI scripts and server modules: executable scripts pose a threat as they do things that the authors did not anticipate.
Server side include: allows web authors to create HTML pages that change dynamically without restoring to full-blown scripts or plug-ins.
Start and stop the server without using root privileges: this is to reduce the use of root account.
3 mores
2019/5/4
Y K Choi

10. You should review the logs to determine who has accessed your systems.
Monitoring the logs
Unix system logs: it keeps a series of log files and you can find them in /usr/adm
Server log: The files created by Web servers are useful for tracking down problems. Most servers creates two logs: access logs and servers logs.
You should review the logs to determine who has accessed your systems.
2019/5/4
Y K Choi

11. Web Log Tools (no need to memorise)
Product
Manufacturer OS
Notes
Analog
Stephen Turner
NT/Unix
Freeware
wusage
Boutell Corp.
wwstat
Roy Fielding
Site Tracker
Tucker info.
All OS
Net.analysis
Net.genesis
NT/Solaries
Don’t memorise
2019/5/4
Y K Choi

12. Error Logs Some of the error messages that you can find are:
File does not exist: access a URL that does not exist
File permissions deny server access: access a document that does not have sufficient privileges to read it.
Password mismatch: access a protected document with an incorrect password
Client denied by server configuration: access to a directory is restricted to certain IP addresses
Malformed header from script: This is a warning message showing that a bad output cannot be interpreted correctly.
2019/5/4
Y K Choi

13. Summary
Unix is not a perfect OS, we need to harden this by: 1) downloading the latest patch, 2) disabling unnecessary services, 3) minimizing the number of users, etc.
Configure the Web server: minimise the use of privileged user, limit DOS
Monitor the logs: Unix system logs, server log and error log
2019/5/4
Y K Choi