Securing the web server

In this recipe, we will learn some steps for securing web server installation.

Getting ready

You will need access to a root account or an account with sudo privileges.

You may need to have a web server stack installed and running.

How to do it…

Follow these steps to secure the web server:

1. Disable any unwanted modules. You can check all enabled modules with the following command:

   $ a2query -m
   

2. Disable modules with the following command:

   $ sudo a2dismod status
   

3. Hide the web server's identity. For Apache, edit /etc/apache2/conf-available/security.conf and set the following values:

   ServerSignature Off
   ServerTokens Prod
   

4. You may want to check other options under security.conf.
5. Next, disable the Apache server status page:

   $ sudo a2dismod status
   

6. For Nginx, edit /etc/nginx/nginx.conf and uncomment the following line:

   # server_tokens off;
   

7. In production environments, minimize the detail shown on error pages. You can enable the PHP Suhosin module and strict mode.
8. Disable directory listing. On Apache, add the following line to the virtual host configuration:

   <Directory /var/www/example.com>
    Options -Indexes
   </Directory>
   

9. You can also disable directory listing globally by setting Options -Indexes in /etc/apache2/apache2.conf.
10. Restrict access to the following directories:

    <Directory /var/www/ >
     Order deny,allow # order of Deny and Allow
     Deny from all # Deny web root for all
    </Directory>
    

11. Disable directory level settings and the use of .htaccess. This also helps improve performance:

    <Directory />
     AllowOverride None # disable use of .htaccess
    </Directory>
    

12. Disable the following symbolic links:

    <Directory />
     Options -FollowSymLinks
    </Directory>
    

13. You can also install mod_security and mod_evasive for added security. mod_security acts as a firewall by monitoring traffic in real time, whereas mod_evasive provides protection against Denial of Service attacks by monitoring request data and requester IP.
14. For Apache, you can install mod_security as a plugin module as follows:

    $ sudo apt-get install libapache2-modsecurity
    $ sudo a2enmod mod-security
    

15. On Nginx, you need to first compile mod_security and then compile Nginx with mod_security enabled.
16. Turn of server side includes and CGI scripts:

    <Directory />
     Options -ExecCGI -Includes
    </Directory>
    

17. Limit request body, headers, request fields, and max concurrent connections; this will help against DOS attacks.
18. Set the following variables on Apache:

    TimeOut
    KeepAliveTimeout
    RequestReadTimeout
    LimitRequestBody
    LimitRequestFields
    LimitRequestFieldSize
    LimitRequestLine
    MaxRequestWorkers
    

19. For Nginx, configure the following variables to control buffer overflow attacks:

    client_body_buffer_size
    client_header_buffer_size
    client_max_body_size
    large_client_header_buffers
    

20. Enable logging and periodically monitor logs for any new or unrecognized events:

    <VirtualHost *:80>
     
    ErrorLog /var/log/httpd/example.com/error_log
     CustomLog /var/log/httpd/example.com/access_log combined
    </VirtualHost>
    

21. Set up HTTPs and set it to use modern ciphers. You can also disable the use of SSL and enforce TLS.

How it works…

In this recipe, I have listed the various options available to make your web server more secure. It is not necessary to set all these settings. Disabling some of these settings, especially FollowSymlinks and AllowOverride, may not suit your requirements or your environment. You can always choose the settings that apply to your setup.

Various settings listed here are available in their respective configuration files, mostly under /etc/apache2 for the Apache web server and /etc/nginx for the Nginx server.

Also, do not forget to reload or restart your server after setting these options.

You should also set your Ubuntu environment to be more secure. You can find more details on securing Ubuntu in Chapter 2, Networking.

See also

• Installing mod_evasive at https://www.linode.com/docs/websites/apache-tips-and-tricks/modevasive-on-apache
• Apache security tips at http://httpd.apache.org/docs/2.4/misc/security_tips.html
• Setting up mod_security at https://www.digitalocean.com/community/tutorials/how-to-set-up-mod_security-with-apache-on-debian-ubuntu