26
votes
4answers
1k views

Does /usr/sbin/nologin as a login shell serve a security purpose?

In my /etc/passwd file, I can see that the www-data user used by Apache, as well as all sorts of system users, have either /usr/sbin/nologin or /bin/false as their login shell. For example, here is a ...
1
vote
1answer
41 views

apache mod_security and performance

I have a list of bots to block, so I was thinking that fail2ban could be a solution until I realized that mod_security would be more efficient in this kind of tasks. The number of bots is huge, so ...
1
vote
1answer
89 views

Security for a web server for multiple people?

I have an apache web server set up where multiple people have their websites hosted, mostly php based websites. The problem is, when these people upload their website files, it has read permissions ...
1
vote
1answer
145 views

Preventing script execution and file downloads in a directory?

I have a directory on my website where I'm storing files uploaded by users. I use a whitelist for uploaded file types and also save the files with hashed names, but from what I've read another good ...
1
vote
2answers
726 views

Minimize PHP.CGI.Argument.Injection and further hardening of the Centos 6.4 web server

We have Centos 6.4 server with a physical firewall. We keep seeing quite an number of PHP.CGI.Argument.Injection is detected by the firewall. On the server itself we have done the basic apache ...
0
votes
1answer
967 views

Security - Giving Apache write access to /var/www/html

I am running Worpdress on an CentOS Webserver. Now, to enable wordpress to be able to upload/write files to the default webserver directory /var/www/html I had to do the following change on the ...
3
votes
1answer
698 views

Benchmarking Apache using ab

I was doing some performance testing for Apache using ab. Apache in our case is only working as a load balancer balancing load between two Liferay servers. Initially, I did the testing for 1000 ...
1
vote
1answer
245 views

LAMP Server setup for personal development

I am setting up a LAMP server in VirtualBox for personal development. This will be an Ubuntu Server 12.04 install, and I will be using Virtual Hosts for Drupal, Yii, and other small PHP apps. Ideally ...
2
votes
1answer
885 views

Apache boot without asking for passwd

So I'm maintaining a server which has a verified SSL certificate setup, however there is a password on the private key and so whenever apache is reboot, we get a message asking for the password. This ...
2
votes
1answer
282 views

How to move the /var/www directory to a USB HDD?

I have a default OpenBSD 5.1 install. How Can I enabled httpd, OK. QUESTION: How can I use the /dev/sd0a on /mnt/usbhdd type ffs (local, nodev) instead of the default "/var/www" directory? What ...
4
votes
1answer
1k views

How to configure permissions to allow apache to securely have access to a file in a shared environment?

This is a follow up question from my previous, but I felt it might be more Linux based. http://serverfault.com/questions/414207/how-to-set-linux-permissions-to-allow-apache-to-have-access-to-a-file ...
4
votes
2answers
776 views

How to set secure permissions for multiple users and multiple websites?

On a Gentoo 3.2.12 server with apache2+php, there are several websites running: /www /website1 /website2 ...etc The apache user should have read-only access to all the websites. There ...
15
votes
2answers
43k views

What user should apache and PHP be running as? What permissions should /var/www files have?

I just spun up an Ubuntu 11.10 box and then ran apt-get install apache2 php5 to install apache2 and PHP 5 on the box. Now it is functioning as a "web server" and it loads the "It Works!" page. Now I'm ...
7
votes
1answer
549 views

Opening port 80 but remain secure

I have a standard installation of Ubuntu 10.04, and have installed the LAMP stack so I can do some web development locally. On my router I have opened port 80 so I can develop with external services ...