HowTo: Secure your Ubuntu Apache Web Server

    Date16 Mar 2010
    CategoryFeatures
    218005
    Posted ByAnthony Pell
    Setting up a web server with Apache on a Linux distribution is a very quick process, however to make it a secure setup takes some work. This article will show you how to make your Apache web server more secure from an attack by effectively using Access control and authentication strategies.



    Bill Keys
    All the examples below assumes that you are using Ubuntu 7.10 with a basic Apache configuration setup. However, these examples will help any user running an Apache server to make it more secure since the concepts will still apply. This HOWTO should be used on a test server then once that is secure migrated to a production web server.



    File Permissions and Access Control

    Users and groups:

    One of the first things to ensure is that Apache does not run as root because if Apache is cracked then an attacker could get control of the root account. Lets take a look at what user and group Apache is running as.

    Run the following command:

    # ps auwwfx | grep apache www-data 25675 0.0 0.0 10348 508 ? S Jan21 0:00 \_ /usr/sbin/apache2 -k start
    www-data 25686 0.0 0.2 231816 2208 ? Sl Jan21 0:00 \_ /usr/sbin/apache2 -k start
    www-data 25688 0.0 0.2 231816 2200 ? Sl Jan21 0:00 \_ /usr/sbin/apache2 -k start
    As you can see www-data is the user running Apache. However if it's not then you need to edit your Apache configurations and create a new user and group by:

    # groupadd www-data
    # useradd -g www-data www-data
    # vi /etc/apache2/apache2.conf
    Change:
    User root
    Group root
    To:
    User www-data
    Group www-data
    Do a reload to make sure the changes take effect:
    # /etc/init.d/apache2 reload
    Permissions to serve files:

    One of the most overlooked security practices is correctly using the chmod command. For example, we just created a index.cgi in our Apache html root directory but when we go to open the file in our browser we get the error message permission denied. To get our index.cgi file working we do a chmod 777 index.cgi. Before you try this, every Apache administrator should think to themselves' is this secure? The answer should be NO! But how do we make the permissions secure enough and allow the index.cgi script to work?
    chmod:
    Apache needs to have permission to execute the index.cgi file. However, we don't want everyone to read and write to index.cgi. The owner of the file should have permission to read and write to the file. We do this by:
    # chmod 755 index.cgi
    Files outside the web root should not be served:

    It's very important to have the following lines in your apache.conf:

    Options FollowSymLinks
    AllowOverride None

    Notes
    1.The above lines prevent Apache from having access to files outside of its web root.
    2.Some distributions have better default security configuration then others. EnGarde Secure Linux is one example where they include the above lines in their Apache configuration file by default.

    We don't want users running CGI scripts anywhere on the filesystem but we do need them to run in the web root. The solution to this problem is the "Options ExecCGI" directive.

    Example:
    Add the following lines to /etc/apache2/apache2.conf:

    AllowOverride None
    Options ExecCGI
    Order allow,deny
    Allow from all
    Reload apache:
    # /etc/init.d/apache2 reload
    What if your have resources that should only be accessed by a certain network or IP address?
    A solution to this problem is using our Apache configuration to enforce it for you.

    Example only allow access to network 192.168.0.0.

    Change the following lines in your /etc/apache2/apache2.conf:

    AllowOverride None
    Options ExecCGI
    Order allow,deny
    Allow from all
    To:

    AllowOverride None
    Options ExecCGI
    Order Deny,Allow
    Deny from all
    Allow from 192.168.0.0/16
    Do a reload to make sure the changes take effect:
    # /etc/init.d/apache2 reload
    Now only users on you internal network can run CGI script in "/home/username/public_html/cgi-bin"

    Authentication

    How can we allow only users with the correct password and username to have access to a part of our web root? The following steps will show you how to do this securely.

    Basic authentication:

    Enable .htaccess
    # vi /etc/apache2/apache2.conf
    Change:
    AllowOverride None
    To:
    AllowOverride AuthConfig
    Do a reload to make sure the changes take effect:
    # sudo /etc/init.d/apache2 reload
    Create a password file:
    # mkdir /var/www/misc
    # chmod a+rx /var/www/misc
    # cd /var/www/misc
    # htpasswd -bc private.passwords username password
    Adding password for user username

    Create .htaccess
    # cd /home/username/public_html/cgi-bin
    # vi .htaccess
    Add the below in .htaccess
    AuthName My Private Area"
    AuthType Basic
    AuthUserFile /var/www/misc/private.passwords
    AuthGroupFile /dev/null require valid-user
    Change:

    AllowOverride None
    Options ExecCGI
    Order Deny,Allow
    Deny from all
    Allow from 192.168.0.0/16

    To:

    AllowOverride .htaccess
    Options ExecCGI
    Order Deny,Allow
    Deny from all
    Allow from 192.168.0.0/16

    Do a reload to make sure the changes take effect:
    # /etc/init.d/apache2 reload
    Digest authentication:
    Another method for authentication is called digest authentication. With digest authentication your password is never sent across the network in the clear because they are always transmitted as an MD5 digest of the user's password. This way passwords cannot be determined by sniffing network traffic:
    Create a password file:
    # mkdir /var/www/misc
    # chmod a+rx /var/www/misc
    # cd /var/www/misc
    # htdigest -c private.passwords realm username
    Adding password for username in realm realm.
    New password:
    Create .htaccess
    # cd /home/username/public_html/cgi-bin
    # vi .htaccess
    Add the below in .htaccess
    AuthName "My Private Area"
    AuthType Digest
    AuthUserFile /var/www/misc/private.passwords
    AuthGroupFile /dev/null require valid-user
    Notes
    1.For more information on htdigest please check the man pages.
    2.Some older versions of Web browsers don't support Digest authentication.
    3.To fully protect your .htaccess use SSL.

    Where to go from here?
    The next step in a more secure Apache is to use some of the Apache modules decided for helping Apache security even more. Some examples are mod_security and mod_chroot. Also, to protect our authentication we will need to configure SSL. In a upcoming HOWTO it will show you how to use SSL to further increase your web server's security and other advance techniques. What ways would you suggest to best secure a Apache web server?

    References:

    Security Tips for Server Configuration:
    Apche.org - Security Tips

    Security and Apache: An Essential Primer:
    Linuxplanet/- Apache Tutorial

    Apache Homepage:
    http://www.apache.org
    You are not authorised to post comments.

    LinuxSecurity Poll

    What is your favorite LinuxSecurity.com feature?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /component/communitypolls/?task=poll.vote&format=json
    17
    radio
    [{"id":"65","title":"Feature articles","votes":"0","type":"x","order":"1","pct":0,"resources":[]},{"id":"66","title":"News","votes":"1","type":"x","order":"2","pct":33.33,"resources":[]},{"id":"67","title":"HOWTOs","votes":"2","type":"x","order":"3","pct":66.67,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.