Steps take to harden Apache and IBM Web Servers

Apache does not run as root or as a “super-user”. We run Apache from the apache account a non-shared User-id and Group-id which has a home directory in a private directory.

All web servers run in the first tier and in the corporate “Yellow” firewall zone.

We do not allow telnet, shell or any other non-defined access inward from web servers to any higher tiers.

Logging from Apache and the host systems is sent and stored off the host system to an internal logging system where it cannot be erased, modified or tampered with. This logging is also scraped by monitoring software.

We only allow connections to TCP ports 80 and 443 if needed for Secure Sockets Layer.

Web servers perform no other ancillary functions such as remote command execution, CGI, web services or application serving. Now we do serve Java Server Pages in the first tier. Ancillary functions are limited to a few cases of mod_php inline with Apache itself and a non-root user. Application server access is “proxied” from the web server to the second or third tier.

Web servers are front ended by Cisco network gear such as PIX firewall and Content Services Switches.

Packets that originate in the first tier never terminate in higher tiers. Instead packets are re-created by Apache or IBM Internet Host Servers (IBM’s version of Apache) plug-ins and sent directly from the web server to the application server or the second tier.

We use the latest versions of OpenSSL a well known and secure Secure Sockets Library.

All sites having external exposure and requiring a Secure Sockets Connection are registered and deployed with certificates from well known Certification Authority such as Verisign or Entrust.

Externally facing Apache is configured to disable the following potentially dangerous modules: 

mod_info	Gives out too much information about the web server to potential attackers.
	
mod_status	Gives out server stats via web pages.	
mod_autoindex	Provides directory listings when no index.html file is present.	
mod_imap	Provides server-side mapping of index files.	
mod_ include	Provides server-side includes (.shtml files).	
mod_userdir	Translates URLs to user-specific directories.	
mod_ auth	Authentication against LDAP via mod_auth_ldap.	
mod_dav	DAV authoring is not allowed.	
mod_frontpage	Microsoft Front Page extension are disabled.	

The following httpd.conf directives are used to obfuscate server configuration and other useful information from being accessed remotely:

ServerSignature Off	Prevents server from giving version info on error pages.
	
User apache	Ensure that the child processes run as unprivileged user	
Group apache	Ensure that the child processes run as unprivileged group	
ServerTokens Prod	Prevents server from giving version info in HTTP headers	
ErrorDocument 404 errors/404.html
ErrorDocument 500 errors/500.html
etc.
	To further obfuscate the web server and version, this will redirect to a page that you should create, rather than using the default Apache pages. If the a 404 content page does not already exist from the content provider a 404.html should be created to redirect to the sites main page for a invalid or missing URI. A standard 505.html should be created to display something to the effect of “The server is experiencing a high load right now, please retry your request.”	
ServerAdmin	HAR-ORL-IT-WebServices@harcourt.com	
<Directory />
    Order Deny, Allow
    deny from all
</Directory>
	Deny access to the root file system.	
<Directory /usr/local/httpd/htdocs">
  <LimitExcept GET POST>
       deny from all
  </LimitExcept>
    Options 
          FollowSymLinks
          Includes
          Indexes
          MultiViews
          AllowOverride None
          Order allow,deny
          Allow from all
</Directory>
	LimitExcept prevents TRACE from allowing attackers to find a path through cache or proxy servers.
 
The “-“ before any directive disables that option.
 
FollowSymLinks allows a user to navigate outside the doc tree, and Indexes will reveal the contents of any directory in your doc tree.
 
Includes allows .shtml pages, which use server-side includes (potentially allowing access to the host).  If you really need SSI, use IncludesNoExec instead.
 
AllowOverride None will prevent developers from overriding these specifications in other parts of the doc tree.
	
AddIcon (remove) 
IndexOptions (remove)
AddDescription (remove)
ReadmeName (remove)
HeaderName (remove)
	Remove all references to these directives, since we disabled the fancy indexing module.
	
Alias /manual (remove)	Don’t provide any accessible references to the Apache manual

Disable HTTP TRACE method:

http://www.cgisecurity.com/whitehat-mirror/WH-WhitePaper_XST_ebook.pdf

TRACE requests can be disabled by making a change to the Apache server configuration. Unfortunately it is not possible to do this using the Limit directive since the processing for the TRACE request skips this authorization checking. Instead the following lines can be added which make use of the mod_rewrite module. 

RewriteEngine On 
RewriteCond %{REQUEST_METHOD} ^TRACE 
RewriteRule .* - [F] 

Although the particular attack highlighted made use of the TRACE functionality to grab authentication details, this isn't a vulnerability in TRACE, or in the Apache web server. The same browser functionality that permits the published attack can be used for different attacks even if TRACE is disabled on the remote web server. For example an attacker could create a carefully crafted page that when visited submits a hidden request to some arbitrary site through your browser, grabs the result and passes it to the attacker. 

Remove default Apache files.
 
It’s important to remove default files such as .html files, CGI scripts and the Apache manual).  This will help obfuscate the server you’re running, targeted attacks against your web server.  You’ll probably want to build a simple index.html page to place in the htdocs directory, just so you know the web server is working when you start it.
 
# rm –Rf /usr/local/httpd/htdocs/*
# rm –Rf /usr/local/httpd/cgi-bin/*
# rm –Rf /usr/local/httpd/icons

Set directory and file permissions for the server. 

These are typical Apache directories. The actual directory names may vary.

•	bin is where the executable portion of the Apache web server is.  It should be readable/executable only by members of the apache group, but only writable by root.
 
# chown –R root:apache /usr/local/httpd/bin 
# chmod –R 770 /usr/local/bin
 
•	conf is where your web server configuration files are and needs to be read/writable only by the webadmin group.
 
# chown –R root:apache /usr/local/httpd/conf
# chmod –R 770 /usr/local/httpd/conf
 
•	logs is where your access and error logs will go.  It should be readable only by the webadmin group.
 
# chown –R root:apache /usr/local/httpd/logs
# chmod –R 755 /usr/local/httpd/logs
 
•	htdocs is where your HTML files are and needs to be world readable, but writable only by root (you should copy content in from a staging server).
 
# chown –R root /usr/local/httpd/htdocs
# chmod –R 775 /usr/local/httpd/htdocs
 
•	cgi-bin is where your executable scripts are and needs to be accessible by root only since we do not allow CGI operation externally.
 
# chown –R /usr/local/httpd/cgi-bin
# chmod –R 700 /usr/local/httpd/cgi-bin

Keep the web server patched.
 
Check web sites for Apache and all modules regularly and apply important patches.
 
Apache web server: http://nagoya.apache.org/dist/httpd/patches/
 
OpenSSL: http://www.openssl.org/source
 
OpenLDAP: http://www.openldap.org/

Configure authentication against an LDAP directory if needed.
 
In this final section, we’ll configure the Apache httpd.conf file so that resources are authenticated against an LDAP server.  This step really can’t be run until you’ve installed the web server.  Once you’ve got your web server installed, just add the LDAP authentication directives to any directory (or httpd.conf file) where you want password protection with CEC credentials.  Here’s an example of protecting a directory named “Internal”
 
<Location "/some_content_location">
     AuthName CEC
     AuthType Basic
     AuthLDAPURL ldap://harorldcxp003.edu.regn.net:389/CN=svc-eduharorlweb001,OU=ORL,OU=HSG,OU=Service,OU=User Accounts,DC=edu,DC=regn,DC=net require valid-user
</Location>