Security/Services/Apache
Sécuriser son serveur Apache
C'est ballot de mettre une serrure aux fenêtres si la porte reste grande ouverte. C'est pourquoi, si les logiciels ne sont pas à jour ou que les patchs de sécurités ne sont pas appliqués, la sécurisation n'aurait pas de sens et ne serait qu'un arbre qui cache la forêt.
Apache
Cacher le numéro de version et autres informations sensibles
Par défaut, Apache rapporte les informations suivantes:
- numéro de version d'Apache
- Liste des modules installés
- Système d'exploitation et numéro de version de celui-ci
Ajout/modification des directives dans le fichier <path>/etc/httpd/conf/httpd.conf</path>
ServerSignature Off
ServerTokens Prod
La clé ServerSignature provoque l'affichage d'informations sensibles dans les pages d'erreur (403, 404 notamment), ainsi que dans les pages auto-générées listant les fichiers du répertoire.
La clé ServerTokens est utilisée pour déterminer si des informations doivent apparaître dans l'en-tête de réponse. Si la valeur de cette clé est Prod, la seule information sera:
Server: Apache
Pour qu'Apache rapporte autre chose que apache , il faut soit éditer les sources, soit utilisé le module mod_security
S'assurer qu'apache tourne avec son propre user et group
Beaucoup de serveurs web tourne avec le user nobody ou daemon. Dans le cas où Apache serait compromis, tous les processus utilisant le même user le serait aussi rapidement, et inversement.
User apache
Group apache
Ensure that files outside the web root are not served
We don't want apache to be able to access any files out side of its web root. So assuming all your web sites are placed under one directory (we will call this /web), you would set it up as follows:
<Directory />
Order Deny,Allow
Deny from all
Options None
AllowOverride None
</Directory>
<Directory /web>
Order Allow,Deny
Allow from all
</Directory>
Turn off directory browsing
You can do this with an Options directive inside a Directory tag. Set Options to either None or -Indexes
Options -Indexes
Turn off server side includes
This is also done with the Options directive inside a Directory tag. Set Options to either None or -Includes
Options -Includes
Turn off CGI execution
If you're not using CGI turn it off with the Options directive inside a Directory tag. Set Options to either None or -ExecCGI
Options -ExecCGI
Don't allow apache to follow symbolic links
This can again can be done using the Options directive inside a Directory tag. Set Options to either None or -FollowSymLinks
Options -FollowSymLinks
Turning off multiple Options
If you want to turn off all Options simply use:
Options None
If you only want to turn off some separate each option with a space in your Options directive:
Options -ExecCGI -FollowSymLinks -Indexes
Turn off support for .htaccess files
This is done in a Directory tag but with the AllowOverride directive. Set it to None.
AllowOverride None
If you require Overrides ensure that they cannot be downloaded, and/or change the name to something other than .htaccess. For example we could change it to .httpdoverride, and block all files that start with .ht from being downloaded as follows:
AccessFileName .httpdoverride
<Files ~ "^\.ht">
Order allow,deny
Deny from all
Satisfy All
</Files>
Run mod_security
mod_security is a super handy Apache module written by Ivan Ristic, the author of Apache Security from O'Reilly press.
You can do the following with mod_security:
- Simple filtering
- Regular Expression based filtering
- URL Encoding Validation
- Unicode Encoding Validation
- Auditing
- Null byte attack prevention
- Upload memory limits
- Server identity masking
- Built in Chroot support
- And more
Disable any unnecessary modules
Apache typically comes with several modules installed. Go through the apache module documentation and learn what each module you have enabled actually does. Many times you will find that you don't need to have the said module enabled.
Look for lines in your httpd.conf that contain LoadModule. To disable the module you can typically just add a # at the beginning of the line. To search for modules run:
grep LoadModule httpd.conf
Here are some modules that are typically enabled but often not needed: mod_imap, mod_include, mod_info, mod_userdir, mod_status, mod_cgi, mod_autoindex. Make sure only root has read access to apache's config and binaries
This can be done assuming your apache installation is located at /usr/local/apache as follows:
chown -R root:root /usr/local/apache
chmod -R o-rwx /usr/local/apache
Lower the Timeout value
By default the Timeout directive is set to 300 seconds. You can decrease help mitigate the potential effects of a denial of service attack.
Timeout 45
Limiting large requests
Apache has several directives that allow you to limit the size of a request, this can also be useful for mitigating the effects of a denial of service attack.
A good place to start is the LimitRequestBody directive. This directive is set to unlimited by default. If you are allowing file uploads of no larger than 1MB, you could set this setting to something like:
LimitRequestBody 1048576
If you're not allowing file uploads you can set it even smaller.
Some other directives to look at are LimitRequestFields, LimitRequestFieldSize and LimitRequestLine. These directives are set to a reasonable defaults for most servers, but you may want to tweak them to best fit your needs. See the documentation for more info.
Limiting the size of an XML Body
If you're running mod_dav (typically used with subversion) then you may want to limit the max size of an XML request body. The LimitXMLRequestBody directive is only available on Apache 2, and its default value is 1 million bytes (approx 1mb). Many tutorials will have you set this value to 0 which means files of any size may be uploaded, which may be necessary if you're using WebDAV to upload large files, but if you're simply using it for source control, you can probably get away with setting an upper bound, such as 10mb:
LimitXMLRequestBody 10485760
Limiting Concurrency
Apache has several configuration settings that can be used to adjust handling of concurrent requests. The MaxClients is the maximum number of child processes that will be created to serve requests. This may be set too high if your server doesn't have enough memory to handle a large number of concurrent requests.
Other directives such as MaxSpareServers, MaxRequestsPerChild, and on Apache2 ThreadsPerChild, ServerLimit, and MaxSpareThreads are important to adjust to match your operating system, and hardware.
Restricting Access by IP
If you have a resource that should only by accessed by a certain network, or IP address you can enforce this in your apache configuration. For instance if you want to restrict access to your intranet to allow only the 176.16 network:
Order Deny,Allow
Deny from all
Allow from 176.16.0.0/16
Or by IP:
Order Deny,Allow
Deny from all
Allow from 127.0.0.1
Adjusting KeepAlive settings
According to the Apache documentation using HTTP Keep Alive's can improve client performance by as much as 50%, so be careful before changing these settings, you will be trading performance for a slight denial of service mitigation.
KeepAlive's are turned on by default and you should leave them on, but you may consider changing the MaxKeepAliveRequests which defaults to 100, and the KeepAliveTimeout which defaults to 15. Analyze your log files to determine the appropriate values.
Run Apache in a Chroot environment
chroot allows you to run a program in its own isolated jail. This prevents a break in on one service from being able to effect anything else on the server.
It can be fairly tricky to set this up using chroot due to library dependencies. I mentioned above that the mod_security module has built in chroot support. It makes the process as simple as adding a mod_security directive to your configuration:
SecChrootDir /chroot/apache
There are however some caveats however, so check out the docs for more info.
PHP
Cacher le numéro de version
PHP expose son numéro de version ( par défaut ? ). En effet il suffit de lancer la commande suivante pour s'en rendre compte. Bien entendu le fichier index.php doit exister, sinon Apache rapporte une erreur 404.
nc localhost 80 << EOF
HEAD http://localhost/index.php http/1.1
host: localhost
EOF
Apache répond en spécifiant le numéro de version de php
HTTP/1.1 200 OK
Date: Thu, 06 Sep 2012 10:03:22 GMT
Server: Apache
X-Powered-By: PHP/5.4.6
Connection: close
Content-Type: text/html; charset=UTF-8
Ajout de la ligne suivante au fichier <path>/etc/php.ini</path>
expose_php = Off
Après la modification et un restart d'Apache plus tard
nc localhost 80 << EOF
HEAD http://localhost/index.php http/1.1
host: localhost
EOF
Cette fois le numéro de version de php est caché
HTTP/1.1 200 OK
Date: Thu, 06 Sep 2012 10:03:22 GMT
Server: Apache
Connection: close
Content-Type: text/html; charset=UTF-8