securing apache web server version 2.0.47

Hi Confident_1967,

What is you OS and version.  AS sopiaz57 mentioned; Apache is pretty mature, and very stabil.  If you ever need to worry, worry on OS (expecially if it is Windows machine).

Since you are new to apache it would be a good time to browse to http://httpd.apache.org/docs/ (or http://httpd.apache.org/docs-2.0/) , and browse to which ever area that might interest you.

Most specifically, you would need to look at the Security Tips section http://httpd.apache.org/docs-2.0/misc/security_tips.html

part of you question to prevent other peopel except those from you domain to download file, you could take a look at the example from Apache FAQ (http://httpd.apache.org/docs/misc/FAQ.html), specifically part on "Stealing Images" (http://httpd.apache.org/docs/misc/FAQ.html#image-theft):

SetEnvIf REFERER "www\.mydomain\.com" linked_from_here
SetEnvIf REFERER "^$" linked_from_here

<Directory /www/images>
    Order deny,allow
    Deny from all
    Allow from env=linked_from_here
</Directory>

You could customize the section to match your requirement.

Another part about not wanting people to attack your server -- take it offline, and never plug it to the network -- just kidding.  But it is true.  Bottom line is, try to minimize services running on the machine, and only allow things that are needed.  If you are behind firewall, only allow just the "required" network to comes in, and block others.

Security itself is a bit chuck to talk about, but minimizing the point of entry would be the basic steps that you could implement.

cheers.

I found this, it's a great resource.
http://www.apacheweek.com/security/


Hey Samri, i see this a lot and never know how to read it. Can u briefly explain or do u have a site that explains?
thanks!

<Directory /www/images>
   Order deny,allow
   Deny from all
   Allow from env=linked_from_here
</Directory>

hi sopiaz57;

you mean this config segment;
----
1. SetEnvIf REFERER "www\.mydomain\.com" linked_from_here
2. SetEnvIf REFERER "^$" linked_from_here
3.
4. <Directory /www/images>
5.   Order deny,allow
6.   Deny from all
7.  Allow from env=linked_from_here
8. </Directory>
----

Basically this will go to you apachec config file (main server config, or Vhost that you need to have this implemented).

let's go by line;
1. Set the environment var REFERER to linked_from_here if you are coming from www.mydomain.com (make sure you had this fixed to whatever you webserver ServerName is.
2. heck... i'm not sure what is this one too :0
line 4-8 is the directory where you want to protect.  What it really does - anything in /www/images will be denied unless if the environmet variable REFERER =linked_from_here.

This concept would work for most occassion but will failed if - 1. the browser does not transmit REFERER http_environment var, or REFERER is faked, which is possible.  

This would not be a foolproof solution, but should work in most ocassion.  don't be surprise, some adult pay-site is implementing this kind of authentication (and they sure do make money!).

hope this helps.

Hey thats great thanks, you know whats always been confusion is the deny,allow statements. (line 5)  

Lets say for example i have my apache server up and running and i dont want anyone from 148.137.x.x to have access, is that what i would have.


<Directory /www/html>
order deny,allow
allow from all
deny from 148.137
</Directory>

Now thats just standard http server, not a virtual server setup.  If i were to run a virtual server (name based is what im planning) i would just put that directive in my <virtual host> </virtual host> tag?

operating system is windows xp home edition (but i have many operating systems to choose from ..what would be best to run this ?  i can get anything)

thanks for everything guys ...please keep it comming... my wish is to sercure every freaking hole i can.

im just so new to all of this ... and i am gradually reading all of this ... please keep it comming ...will go over everything  and award points in a few days as the expertice rolls in.

THANKS AGAIN !!!!!!!!!!