Hardening Apache Tony Mobily
Publisher:

Just because you're small doesn't matter. After having been through security audits over the years I now have a short list of things I always change after having installed an Apache HTTP Server. Linux : Basic Server Hardening Steps (cPanel). TLS compression is a different beast though: as of Apache 2.2.23, it's not possible to switch it off inside of Apache. System hardening is crucial to securing your systems and preventing attacks. I just recompiled apache/php with some extra modules like suhosin, mod_security and suphp by using easyapache. Your apache + PHP installation may not be as secure as you think it is. Do i have to configure mod_security and. Security benchmarks, such as those from CIS, offer very detailed system hardening guidelines. It is not much, but it always moves the focus from the Apache. Step 1 : To reduce the risk of hackers accessing all sites on the server from a compromised PHP web script, you should enable phpsuexec when you build apache/php. At the end of my Hardening Enterprise Apache Installations Against Attacks presentation at ApacheCon US 2008 I had a slide of interesting reading material. Hardening Your Web Server's SSL Ciphers Apache This should work on both Apache 2.2 and 2.4. What are the goals of those trying to attack? The Threat Model - Who gets attacked?