13.09.2016 Views

PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Securing Your <strong>Web</strong> Server <strong>and</strong> <strong>PHP</strong><br />

381<br />

conf or C:\Program Files\Apache Software Foundation\Apache2.2\conf).You<br />

should definitely make sure that you have read the appropriate security sections in the<br />

online documentation for the server (http://httpd.apache.org/docs-project).<br />

In addition, you should do the following:<br />

n Make sure that httpd runs as a user without super-user privileges (such as nobody<br />

or httpd on UNIX).This is controlled by the User <strong>and</strong> Group settings in<br />

httpd.conf.<br />

n Make sure that the file permissions on the Apache installation directory are set<br />

correctly. On UNIX, this involves making sure that all the directories except for<br />

the document root (which defaults to using the htdocs/ subdirectory) are owned<br />

by root <strong>and</strong> have permissions of 755.<br />

n Make sure the server is set up to h<strong>and</strong>le the correct number of connections. For<br />

users of the 1.3.x versions of httpd, you will want to set the value of MaxClients<br />

to some reasonable number of clients that can be processed at one time (the<br />

default value of 150 is reasonable, but if you expect a higher load, you may want to<br />

increase it). For Apache 2.x versions, where there is multithreading, you will want<br />

to check the value of ThreadsPerChild (the default of 50 is reasonable).<br />

n Hide files that you do not want seen by including appropriate directives in<br />

httpd.conf. For example, to exclude .inc files from being seen, you could add<br />

the following:<br />

<br />

Order allow, deny<br />

Deny from all<br />

<br />

Of course, as mentioned previously, we will want to move these files out of the document<br />

root for the specified website outright.<br />

Microsoft IIS<br />

Configuring IIS does not revolve around settings files as much as the Apache HTTP<br />

Server does, but there are still a number of things we should do to help secure our IIS<br />

installation:<br />

n Avoid having websites reside on the same drive as the operating system.<br />

n Use the NTFS file system <strong>and</strong> spend the time to remove write permissions from<br />

appropriate locations.<br />

n Delete all the files that are installed by IIS into the document root by default.<br />

Chances are you will not use a vast majority of these files (if not all of them).<br />

Large amounts of content are installed in the \inetpub directory, which, if you do<br />

not use the online configuration tools (<strong>and</strong> you should not—use the iisadmin<br />

utility instead), you will not need.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!