How to install and secure egroupware - Directory UMM

Handler: cgi-script
----------------------------------------
GET /cgi-bin/modsec-test.pl?p=DELETE%20FRoM+users HTTP/1.0
Host: xxx.xxx.xxx.xxx
User-Agent: mod_security regression test utility
Connection: Close
mod_security-message: Access denied with code 406. Pattern match
"delete[[:space:]]+from" at THE_REQUEST.
mod_security-action: 406
HTTP/1.0 406 Not Acceptable
Content-Length: 352
Connection: close
Content-Type: text/html; charset=iso-8859-1
6.3 Optimization and securing of the Apache web server
To secure your web server you should disable all unneeded modules. Activate only what you need to run
your web applications. Running Apache with fewer modules will also improve its performance.
6.3.1 Recommended modules to run
The following is a short overview of what you need to run Apache 2 with eGroupWare. All other modules can
and should be disabled.
� Optimisation of the Apache web server is not for newbies! When you disable some modules in your
httpd.conf you must also comment out some other options. It is strongly recommended that you disable a
module, stop Apache, and start it again…do this one at a time! Take a look for error messages every time.
mod_access.so
mod_auth.so
mod_include.so
mod_log_config.so
mod_expires.so
mod_deflate.so
mod_headers.so
mod_unique_id.so
mod_setenvif.so
mod_mime.so
mod_negotiation.so
mod_dir.so
mod_alias.so
6.3.2 Other Apache configuration options
You can hide information about your Apache web server for security reasons. There are different possibilities for
Apache 1.3 and Apache 2.x.
Reiner Jung Install and Secure eGroupWare Page 37 of 67