1
vote
0answers
25 views

apache mod_security and performance

I have a list of bots to block, so I was thinking that fail2ban could be a solution until I realized that mod_security would be more efficient in this kind of tasks. The number of bots is huge, so ...
1
vote
1answer
69 views

Security for a web server for multiple people?

I have an apache web server set up where multiple people have their websites hosted, mostly php based websites. The problem is, when these people upload their website files, it has read permissions ...
1
vote
1answer
133 views

Preventing script execution and file downloads in a directory?

I have a directory on my website where I'm storing files uploaded by users. I use a whitelist for uploaded file types and also save the files with hashed names, but from what I've read another good ...
1
vote
2answers
624 views

Minimize PHP.CGI.Argument.Injection and further hardening of the Centos 6.4 web server

We have Centos 6.4 server with a physical firewall. We keep seeing quite an number of PHP.CGI.Argument.Injection is detected by the firewall. On the server itself we have done the basic apache ...
0
votes
1answer
764 views

Security - Giving Apache write access to /var/www/html

I am running Worpdress on an CentOS Webserver. Now, to enable wordpress to be able to upload/write files to the default webserver directory /var/www/html I had to do the following change on the ...
3
votes
1answer
602 views

Benchmarking Apache using ab

I was doing some performance testing for Apache using ab. Apache in our case is only working as a load balancer balancing load between two Liferay servers. Initially, I did the testing for 1000 ...
1
vote
1answer
230 views

LAMP Server setup for personal development

I am setting up a LAMP server in VirtualBox for personal development. This will be an Ubuntu Server 12.04 install, and I will be using Virtual Hosts for Drupal, Yii, and other small PHP apps. Ideally ...
2
votes
1answer
722 views

Apache boot without asking for passwd

So I'm maintaining a server which has a verified SSL certificate setup, however there is a password on the private key and so whenever apache is reboot, we get a message asking for the password. This ...
2
votes
1answer
276 views

How to move the /var/www directory to a USB HDD?

I have a default OpenBSD 5.1 install. How Can I enabled httpd, OK. QUESTION: How can I use the /dev/sd0a on /mnt/usbhdd type ffs (local, nodev) instead of the default "/var/www" directory? What ...
4
votes
1answer
1k views

How to configure permissions to allow apache to securely have access to a file in a shared environment?

This is a follow up question from my previous, but I felt it might be more Linux based. http://serverfault.com/questions/414207/how-to-set-linux-permissions-to-allow-apache-to-have-access-to-a-file ...
4
votes
2answers
697 views

How to set secure permissions for multiple users and multiple websites?

On a Gentoo 3.2.12 server with apache2+php, there are several websites running: /www /website1 /website2 ...etc The apache user should have read-only access to all the websites. There ...
12
votes
2answers
40k views

What user should apache and PHP be running as? What permissions should /var/www files have?

I just spun up an Ubuntu 11.10 box and then ran apt-get install apache2 php5 to install apache2 and PHP 5 on the box. Now it is functioning as a "web server" and it loads the "It Works!" page. Now I'm ...
7
votes
1answer
523 views

Opening port 80 but remain secure

I have a standard installation of Ubuntu 10.04, and have installed the LAMP stack so I can do some web development locally. On my router I have opened port 80 so I can develop with external services ...