Introduction to the Apache Web Server - ApacheCon

Section 19
Security
http://httpd.apache.org/docs/misc/security-tips.html
19.1 Overview
Apache has a significantly lower incidence of security problems, and significantly higher speed of resolving
those problems, than that other web server. However, the last several releases have been security bug fix
releases. And, although we try to ship apache ”secure by default”, there are a number of things that you
can do to improve the situation, as well as a lot of things that you can do to make it worse.
Here’s the simplistic list of what you should do.
• Keep file permissions as restrictive as possible
• Disable unused ports
• Remove unnecessary user accounts
• Don’t use telnet
• Limit modules (Don’t have modules installed that you are not using)
• Avoid FrontPage like the plague
• Avoid SSI where not necessary
• Don’t use the system password file for authentication
• Don’t put your password file in a document directory
• Develop on a staging server
• Keep up with OS and Apache security patches.
• Restrict CGI
• Use suexec for CGI
Ok, now, in more detail ...
115