OGH DBA Dag 14 september 2010 Frits Hoogland

More documents

Recommendations

Info

Information spilling A webserver ‘spills’ information about itself– This is controlled with the ‘ServerTokens’ directive– Ranges from ‘Full’ (most information):vxlt090101:~ fritshoogland$ printf "HEAD / HTTP/1.0\n\n" | nc 10.0.1.12 7777HTTP/1.1 200 OKDate: Thu, 06 May 2010 07:59:57 GMTServer: Oracle-Application-Server-11g/11.1.1.2.0Oracle-HTTP-Server (Unix) mod_ssl/11.0.0.0.0 OtherSSL/0.0.0 mod_plsql/11.1.1.0.0 mod_onsint/2.0Last-Modified: Sun, 25 Apr 2010 12:22:40 GMTETag: "25d84f-2b16-4850eb7692400"Accept-Ranges: bytesContent-Length: 11030Connection: closeContent-Type: text/htmlContent-Language: en40Tuesday, September 14, 2010
Information spilling– To ‘Prod’ (least information):vxlt090101:~ fritshoogland$ printf "HEAD / HTTP/1.0\n\n" | nc 10.0.1.12 7777HTTP/1.1 200 OKDate: Thu, 06 May 2010 08:06:04 GMTServer: Oracle-Application-Server-11gLast-Modified: Sun, 25 Apr 2010 12:22:40 GMTETag: "25d84f-2b16-4850eb7692400"Accept-Ranges: bytesContent-Length: 11030Connection: closeContent-Type: text/htmlContent-Language: en41Tuesday, September 14, 2010
Page 1: Oracle HTTP serversecurityOGH DBA D
Page 7 and 8: Firewall!7Tuesday, September 14, 20
Page 9 and 10: Firewallhost.example.comFirewallhos
Page 11 and 12: Firewall Examples of firewalls:- PI
Page 13 and 14: Architecturehost.example.comhost.dm
Page 15 and 16: Webserver Clients communicate with
Page 17 and 18: Tuesday, September 14, 201017
Page 19 and 20: Figure 6 shows the change over time
Page 26 and 27: How to harden? Webserver scanner: N
Page 28 and 29: Example: incorrect config We got a
Page 33 and 34: HTTPSQ: Does HTTPS make your site m
Page 37 and 38: HTTPS HTTPS encrypts communication-
Page 39: Scanning yourself To harden for the
Page 43 and 44: Information spilling No guarantee,
Page 45 and 46: Information spilling Web cache mana
Page 47 and 48: Ports < 1024 On Linux/Unix requires
Page 49 and 50: mod_security Apache module- Functio
Page 51 and 52: mod_security It’s easy to add mod
Page 53 and 54: mod_security Some of the rules it t
Page 55 and 56: Q & AThank you for attending!55Tues
Page 57 and 58: Bibliography & Links hping (packet

OGH DBA Dag 14 september 2010 Frits Hoogland

Create successful ePaper yourself

Delete template?

Save as template?