Here are 20 things you can do to make your apache configuration more secure.
Disclaimer: The thing about security is that there are no guarantees or absolutes. These suggestions should make your server a bit tighter, but don’t think your server is necessarily secure after following these suggestions.
Additionally some of these suggestions may decrease performance, or cause problems due to your environment. It is up to you to determine if any of the changes I suggest are not compatible with your requirements. In other words proceed at your own risk.
First, make sure you’ve installed latest security patches
There is no sense in putting locks on the windows, if your door is wide open. As such, if you’re not patched up there isn’t really much point in continuing any longer on this list. Go ahead and bookmark this page so you can come back later, and patch your server.
Hide the Apache Version number, and other sensitive information.
By default many Apache installations tell the world what version of Apache you’re running, what operating system/version you’re running, and even what Apache Modules are installed on the server. Attackers can use this information to their advantage when performing an attack. It also sends the message that you have left most defaults alone.
There are two directives that you need to add, or edit in your
ServerSignature Off ServerTokens Prod
appears on the bottom of pages generated by apache such as 404 pages, directory listings, etc.
directive is used to determine what Apache will put in the
HTTP response header. By setting it to
it sets the HTTP response header as follows:
If you’re super paranoid you could change this to something other than “Apache” by editing the source code, or by using mod_security (see below).
Make sure apache is running under its own user account and group
Several apache installations have it run as the user
. So suppose both Apache, and your mail server were running as
an attack through Apache may allow the mail server to also be compromised, and vise versa.
User apache Group apache
Ensure that files outside the web root are not served
We don’t want apache to be able to access any files out side of its web root. So assuming all your web sites are placed under one directory (we will call this
), you would set it up as follows:
<Directory /> Order Deny,Allow Deny from all Options None AllowOverride None </Directory> <Directory /web> Order Allow,Deny Allow from all </Directory>
Note that because we setOptions None
this will turn off all options and overrides for the server. You now have to add them explicitly for each directory that requires an Option or Override.
Turn off directory browsing
You can do this with an
directive inside a
Turn off server side includes
This is also done with the
directive inside a
Turn off CGI execution
If you’re not using CGI turn it off with the
directive inside a
Don’t allow apache to follow symbolic links
This can again can be done using the
directive inside a
Turning off multiple Options
If you want to turn off all
If you only want to turn off some separate each option with a space in your
Options -ExecCGI -FollowSymLinks -Indexes
Turn off support for .htaccess files
This is done in a
tag but with the
directive. Set it to
If you require Overrides ensure that they cannot be downloaded, and/or change the name to something other than
. For example we could change it to
, and block all files that start with
from being downloaded as follows:
AccessFileName .httpdoverride <Files ~ "^.ht"> Order allow,deny Deny from all Satisfy All </Files>
You can do the following with mod_security:
- Simple filtering
- Regular Expression based filtering
- URL Encoding Validation
- Unicode Encoding Validation
- Null byte attack prevention
- Upload memory limits
- Server identity masking
- Built in Chroot support
- And more
Disable any unnecessary modules
Apache typically comes with several modules installed. Go through the apache module documentation and learn what each module you have enabled actually does. Many times you will find that you don’t need to have the said module enabled.
Look for lines in your
. To disable the module you can typically just add a
at the beginning of the line. To search for modules run:
grep LoadModule httpd.conf
Here are some modules that are typically enabled but often not needed:
Make sure only root has read access to apache’s config and binaries
This can be done assuming your apache installation is located at
chown -R root:root /usr/local/apache chmod -R o-rwx /usr/local/apache
Lower the Timeout value
By default the
directive is set to 300 seconds. You can decrease help mitigate the potential effects of a denial of service attack.
Limiting large requests
Apache has several directives that allow you to limit the size of a request, this can also be useful for mitigating the effects of a denial of service attack.
A good place to start is the
directive. This directive is set to unlimited by default. If you are allowing file uploads of no larger than 1MB, you could set this setting to something like:
If you’re not allowing file uploads you can set it even smaller.
Some other directives to look at are
. These directives are set to a reasonable defaults for most servers, but you may want to tweak them to best fit your needs. See the documentation for more info.
Limiting the size of an XML Body
If you’re running
(typically used with subversion) then you may want to limit the max size of an XML request body. The
directive is only available on Apache 2, and its default value is 1 million bytes (approx 1mb). Many tutorials will have you set this value to 0 which means files of any size may be uploaded, which may be necessary if you’re using WebDAV to upload large files, but if you’re simply using it for source control, you can probably get away with setting an upper bound, such as 10mb:
Apache has several configuration settings that can be used to adjust handling of concurrent requests. The
is the maximum number of child processes that will be created to serve requests. This may be set too high if your server doesn’t have enough memory to handle a large number of concurrent requests.
Other directives such as
, and on Apache2
are important to adjust to match your operating system, and hardware.
Restricting Access by IP
If you have a resource that should only by accessed by a certain network, or IP address you can enforce this in your apache configuration. For instance if you want to restrict access to your intranet to allow only the 176.16 network:
Order Deny,Allow Deny from all Allow from 22.214.171.124/16
Or by IP:
Order Deny,Allow Deny from all Allow from 127.0.0.1
Adjusting KeepAlive settings
According to the Apache documentation using HTTP Keep Alive’s can improve client performance by as much as 50%, so be careful before changing these settings, you will be trading performance for a slight denial of service mitigation.
KeepAlive’s are turned on by default and you should leave them on, but you may consider changing the
which defaults to
, and the
which defaults to
. Analyze your log files to determine the appropriate values.
Run Apache in a Chroot environment
allows you to run a program in its own isolated jail. This prevents a break in on one service from being able to effect anything else on the server.
It can be fairly tricky to set this up using
due to library dependencies. I mentioned above that the
module has built in chroot support. It makes the process as simple as adding a
directive to your configuration:
There are however some caveats however, so check out the docs for more info.