1. Apache Security Travis Jeffries

2. Introduction Authentication and Authorization Strict Access Methods Defending against Attacks Bad CGI Programs Apache with SSL Exploits Security Topics to be Covered

3. Basic Authentication – Apache Module: Mod_Auth – Sent over the net in plaintext! Bad! Bad! Bad! AuthType Basic AuthName Protected AuthUserFile /dir../passwordfile Require valid-user Satisfy All

4. Digest Authentication Digest Authenticaiton – Apache Module: Mod_Digest – Not Sent over the net in plaintext! Good! –MD5 Hash used AuthType Digest AuthName Protected AuthUserFile /dir../passwordfile Require valid-user Satisfy All

5. Password Creation htpasswd – for basic auth Ex.Htpasswd user.pass bob this adds bob to the user.password file htpasswd [ -c ] [ -m | -d | -s | -p ] passwdfile username htdigest – for digest authentication htdigest [ -c ] passwdfile realm username Never use the systems password file! That is bad! Create your own password files!

6. Strong vs. Weak Auth Weak = the previous lines where we used password authentication Strong = by the network address …. Order deny,allow Deny from all Allow from 124.155.1

7. Per Directory/File Security <Directory /directory/ #strong or weak authentication here.. Satisfy Any Order Deny, Allow Allow from all This sets the /directory/anybody directory without security but the rest of /directory/ is under authentication

8. Defending Against Simple Attacks Preventing Huge Uploads SetEnvIf Content-Length “[1-9][0-9]{4,}” upload_to_large=1 Order Deny,Allow Deny from env=upload_too_large Error document #stuff here to redirect to our own “file_to_large” script

9. Preventing Simple Attacks 2 Another site is using your pics for their content and stealing your bandwidth! Block out the site! SetEnvIfNoCase Referer “^http://([^/]*\.)?filestealingturds.com/” local_referrer=1 Order Allow,Deny Allow from env=local_referrer

10. Brute Force Password Attacks No Solution in Apache –No link between login attempts –You can use mod Apache::BruteWatch Watches the log files and will send an e-mail to the admin if it thinks an attack is happening http://cvs.lplug.org/cvsweb.cgi/Apache-BruteWatch/

11. DOS Attacks Easy Solution: Limit Server Forks Heres the line you change in httpd.conf MAXCLIENTS 5

12. Bad CGI Scripts We will not cover all the possible stupid things a badly written script can do But in the realm of apache itself… –All scripts are run as the user: Nobody –Make sure Nobody can’t write to anything else on the system, so a compromise is sandboxed find / -user nobody find / -group nobody

13. Apache with SSL Mod_SSL – standard on 2.0, can be installed on 1.3 SSL already covered in class so lets talk about tools.. OpenSSL – make keys, make certificate signing requests, sign the certificate if you want to CA.pl – same as above but you can make a.pem file the user can import into the broswer to remove annoying warning messages about the certificate

14. SSL w/ Apache 1.3 –Redirect /secure/ https://secure.domain.com/secure/ 2.0 SSLRequireSSL

15. Sploitz There are a ton! Google “Apache Exploit” to find out. Too many to talk about now. Update constantly and know what version number of apache you have Commands httpd –v or Apachectl status

16. Yay it’s over Ask questions