{"id":18620,"date":"2016-02-23T15:12:59","date_gmt":"2016-02-23T21:12:59","guid":{"rendered":"https:\/\/www.rosehosting.com\/blog\/?p=18620"},"modified":"2022-12-07T09:49:32","modified_gmt":"2022-12-07T15:49:32","slug":"7-basic-tips-to-improve-apache-security","status":"publish","type":"post","link":"https:\/\/www.rosehosting.com\/blog\/7-basic-tips-to-improve-apache-security\/","title":{"rendered":"7 basic tips to improve Apache security"},"content":{"rendered":"
Apache is the most popular and most used web server in the world, and it is the first web server used to serve more than 100 million websites around the world. Apache is know to be very secure web server, but in this article we will explain few basic configuration changes to make Apache even more secure on a CentOS VPS<\/a>.<\/p>\n 1. Keep Apache up to date<\/strong> To update the Apache web server to the latest version available execute the following command<\/p>\n 2. Hide the Apache version and OS identity<\/strong> Open the Apache configuration file, find the directives and make the following changes.<\/p>\n 3. Disable directory listing<\/strong> Open the configuration file with a text editor and add the following directive<\/p>\n Replace ‘\/your\/document\/root’ with the path to the actual document root directory.<\/p>\n 4. Install and use the mod_security module<\/strong> To install and configure mod_security on your CentOS server, please check our installation guide: 5. Disable all unnecessary modules<\/strong> You can check the official Apache documentation for the modules to learn more about their functionality.<\/p>\n All unnecessary modules can be disabled by adding the ‘#’ character at the beginning of the LoadModule line in the web server configuration file. For example:<\/p>\n 6. Limit Request Size<\/strong> The limit of this Apache directive can be set from 0 (unlimited) to 2147483647 (2GB). For example, if you want to allow file upload with size of 100K to the \/var\/www\/html\/upload directory, you can add the following directive in the Apache configuration file.<\/p>\n 7. Enable Logging<\/strong> The ‘log_config_module’ Apache module enables the functionality of the TransferLog, LogFormat, and CustomLog directives that can be used to create a log file.<\/p>\n Of course you don\u2019t have to do any of this if you use one of our Linux VPS Hosting<\/a> services, in which case you can simply ask our expert Linux admins to harden the Apache web server for you. They are available 24\u00d77 and will take care of your request immediately.<\/p>\n PS.<\/strong><\/span> If you liked this post please share it with your friends on the social networks using the buttons on the left or simply leave a reply below. Thanks.<\/p>\n","protected":false},"excerpt":{"rendered":" Apache is the most popular and most used web server in the world, and it is the first web server … <\/p>\n
\nThe most important security tip, not just for Apache, but for all services, applications and scripts is to keep them up to date by upgrading whenever a new version comes out. Apache is actively developed and the security issues are fixed in the new releases.<\/p>\nyum -y update httpd<\/pre>\n
\nThe ServerSignature directive is enabled by default and it displays the version of the Apache installed on your server and the OS you are using. Attackers can easily use this information against your server. In order to hide this important information you need to modify two directives in the Apache configuration file.<\/p>\nvi \/etc\/httpd\/conf\/httpd.conf\r\n\r\nServerSignature Off\r\nServerTokens Prod<\/pre>\n
\nIf the directory listing is not disabled, everyone will be able to list the content of the directories under the document root directory. The directory listing can be disabled using ‘Options’ directive in the Apache configuration file.<\/p>\n<Directory \/your\/document\/root>\r\nOptions -Indexes\r\n<\/Directory><\/pre>\n
\nmod_security is very useful Apache module. It will strengthens the security of the Apache web server and protect your website from various attacks, blocking almost all commonly known exploits.<\/p>\n
\n– Install mod_security with the OWASP core rule set on a CentOS VPS<\/a><\/p>\n
\nApache have a lot of modules and some of them are enabled in the default Apache installation. Not all of them are needed and it is recommended to disable the unused modules. You can use the following command to list all enabled Apache modules<\/p>\nhttpd -M\r\nLoaded Modules:\r\ncore_module (static)\r\nmpm_prefork_module (static)\r\nhttp_module (static)\r\nso_module (static)\r\nauth_basic_module (shared)\r\nauth_digest_module (shared)\r\nauthn_file_module (shared)\r\nauthn_alias_module (shared)\r\nauthn_anon_module (shared)\r\n....<\/pre>\n
vi \/etc\/httpd\/conf\/httpd.conf\r\n# LoadModule auth_basic_module modules\/mod_auth_basic.so\r\n# LoadModule auth_digest_module modules\/mod_auth_digest.so<\/pre>\n
\nThe ‘LimitRequestBody’ Apache directive can be used to limit the number of bytes that are allowed in a request body. The limit mostly depends on your Web site needs. By default, the ‘LimitRequestBody’ limit is set to unlimited and it can make you a victim of a Denial of service attacks (DOS).<\/p>\n<Directory \"\/var\/www\/html\/upload directory\">\r\nLimitRequestBody 102400\r\n<\/Directory><\/pre>\n
\nLog files are always very helpful to get more information about the events that occur on your server. So, it is a good practice to enable Apache logging. It will provide you with more information and details about all client requests made on your web server. In order to enable to Apache logging, you should make sure that the ‘log_config_module’ module is enabled on your server.<\/p>\nhttpd -M |grep log_config_module\r\nSyntax OK\r\nlog_config_module (shared)<\/pre>\n