{"id":1562,"date":"2018-01-19T19:22:59","date_gmt":"2018-01-19T19:22:59","guid":{"rendered":"http:\/\/goofy-trucks.flywheelsites.com\/preventing-web-attacks-with-apache\/"},"modified":"2018-01-19T19:24:53","modified_gmt":"2018-01-19T19:24:53","slug":"preventing-web-attacks-with-apache","status":"publish","type":"post","link":"https:\/\/phpbuilder.com\/preventing-web-attacks-with-apache\/","title":{"rendered":"Preventing Web Attacks with Apache"},"content":{"rendered":"
\n
\n
By Lee Underwood<\/div>\n
on May 23, 2008<\/div>\n<\/p><\/div>\n
\n\n
\n
\n

\"Preventing<\/p>\n

Author: Ryan C. Barnett<\/div>\n
\nSee it on Amazon.com<\/a>.<\/div>\n
\nThe Apache Web server has the largest market share, according to the latest figures<\/a> from Netcraft. Because of its popularity, it’s a very attractive target for hackers. Many system administrators feel that, by using firewalls and SSL, they will be safe from these attacks. According to Ryan Barnett, these measures won’t provide the protection you need.<\/div>\n
\nRyan Barnett<\/a> is heavily involved in the server security business. He is currently chief security officer with EDS, and leads the Operations Security and Incident Response teams for the federal government in Washington, DC. He is also an instructor at the SANS Institute<\/a>, as well as the team lead for the Center for Internet Security Apache Benchmark Project and a member of the Web Application Security Consortium.<\/div>\n
\nIn short, Ryan knows his stuff when it comes to Apache security. And now he has shared a great deal of that information in his book, Preventing Web Attacks with Apache<\/em>, published by Addison Wesley Professional<\/a>.<\/div>\n
\nThe book begins by taking a look at the different factors that impact the security of the server, including a section on technical misconceptions regarding Web security. Many people have a false sense of security brought about by misunderstandings of their Web environment. Ryan does an excellent job of explaining the problems with these “misunderstandings”.<\/div>\n
\nNext, Ryan discusses the building of the foundation of the Web server, the underlying operating system (OS). While not focusing on the OS itself, Ryan takes a look at how it interacts with the server and what is needed to accomplish greater security. Included are a few examples of the mechanics of a server attack, providing keen insight to what is happening behind the scenes.<\/div>\n
\nOnce the OS issues are taken care of, Ryan then gets down to the nitty gritty of downloading and installing the Apache server software. Coming from experience, I can say that this is not any easy task. There are many decisions to be made in this process but Ryan is an excellent guide. From there, Ryan goes into much detail regarding the important, and often overlooked, process of configuring the httpd.conf<\/code> file. To begin, he uses the Nikto open source vulnerability scanner<\/a>. This Web server scanner performs comprehensive tests for multiple items, including over 3,200 potentially dangerous files\/CGIs, versions on over 625 servers, and version specific problems on over 230 servers. In all, the chapter covers 42 pages of detailed, important information.<\/div>\n
\nFrom there, Ryan takes a look at the essential security modules for Apache. This covers SSL, the mod_rewrite<\/code> module, and several other security-related modules.<\/div>\n
\nThe remainder of the book covers prevention and countermeasures in explicit detail. In addition, the appendix contains an Apache module listing and a httpd.conf<\/code> file, which can be used as an example.<\/div>\n
\nOverall, this is an important book to use in securing your server against Web attacks. Many of the exploits covered include denial of service (DoS) attacks, buffer overflows, brute force attacks, and client parameter manipulation. Ryan’s coverage of the Center for Internet Security Apache Benchmarks<\/a> is an excellent guide for configuring the Apache server.<\/div>\n
\nIf you’re involved \u2014 at any level \u2014 with the administration of an Apache server, you need to get a copy of this book. Ryan’s background, coupled with detailed explanations, makes this a must-have book.<\/div>\n<\/div>\n<\/div><\/div>\n","protected":false},"excerpt":{"rendered":"

If you’re involved at any level with the administration of an Apache Web server, you need to get a copy of this book. Ryan Barnett’s background<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-1562","post","type-post","status-publish","format-standard","hentry","category-tutorials"],"_links":{"self":[{"href":"https:\/\/phpbuilder.com\/wp-json\/wp\/v2\/posts\/1562","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/phpbuilder.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/phpbuilder.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/phpbuilder.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/phpbuilder.com\/wp-json\/wp\/v2\/comments?post=1562"}],"version-history":[{"count":1,"href":"https:\/\/phpbuilder.com\/wp-json\/wp\/v2\/posts\/1562\/revisions"}],"predecessor-version":[{"id":2280,"href":"https:\/\/phpbuilder.com\/wp-json\/wp\/v2\/posts\/1562\/revisions\/2280"}],"wp:attachment":[{"href":"https:\/\/phpbuilder.com\/wp-json\/wp\/v2\/media?parent=1562"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/phpbuilder.com\/wp-json\/wp\/v2\/categories?post=1562"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/phpbuilder.com\/wp-json\/wp\/v2\/tags?post=1562"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}