Maximum Apache Security

688 Pages·2002·3.28 MB·English

by  Anonymous

00 067232380x fm 1/11/05 11:35 AM Page i
M
A X IMUM
A
PACHE
S
ECURITY
800 East 96th Street, Indianapolis, Indiana 46240
00 067232380x fm 5/7/02 3:01 PM Page ii
Maximum Apache Security Acquisitions Editor
Shelley Johnston
Copyright © 2002 by Sams Publishing
Development Editor
All rights reserved. No part of this book shall be reproduced, stored
Heather Goodell
in a retrieval system, or transmitted by any means, electronic,
mechanical, photocopying, recording, or otherwise, without
Managing Editor
written permission from the publisher. No patent liability is
Charlotte Clapp
assumed with respect to the use of the information contained
herein. Although every precaution has been taken in the prepara- Project Editors
tion of this book, the publisher and author assume no responsibil- Anthony Reitz
ity for errors or omissions. Nor is any liability assumed for damages George Nedeff
resulting from the use of the information contained herein.
Copy Editors
International Standard Book Number: 0-672-32380-X
Seth Kerney
Library of Congress Catalog Card Number: 2001098211 Chip Gardner
Matt Wynalda
Printed in the United States of America
Indexer
First Printing: June 2002
Aamir Burki
05 04 03 02 4 3 2 1
Proofreader
Suzanne Thomas
Trademarks
Technical Editor
All terms mentioned in this book that are known to be trademarks
Allan Liska
or service marks have been appropriately capitalized. Sams
Publishing cannot attest to the accuracy of this information. Use of Team Coordinator
a term in this book should not be regarded as affecting the validity Amy Patton
of any trademark or service mark.
Media Developer
Dan Scherf
Warning and Disclaimer
Every effort has been made to make this book as complete and as Interior Designer
accurate as possible, but no warranty or fitness is implied. The Gary Adair
information provided is on an “as is” basis. The author and the
Cover Designers
publisher shall have neither liability nor responsibility to any
Anne Jones
person or entity with respect to any loss or damages arising from
Gary Adair
the information contained in this book or from the use of the CD
or programs accompanying it.
00 067232380x fm 5/7/02 3:01 PM Page iii
Contents at a Glance
Introduction.................................................................................1
Part I Getting Started
1 How Apache Handles Security........................................................19
Part II Creating a Secure Apache Host Server
2 The Risks: Cracking Apache...........................................................33
3 Establishing Minimum Server Security.............................................57
4 Environmental Hazards: Apache and Your Operating System...............69
5 Apache, Databases, and Security.....................................................87
Part III Hacking Apache’s Configuration
6 Apache Versions and Security.......................................................109
7 Version 2.0 IPv6 Support.............................................................119
8 Overlording Apache Server: General Administration.........................135
9 Spotting Crackers: Apache Logging Facilities...................................169
Part IV Runtime Apache Security
10 Apache Network Access Control....................................................203
11 Apache and Authentication: Who Goes There?................................225
12 Hacking Secure Code: Apache at Server Side....................................255
13 Hacking Secure Code: Apache at Client Side....................................291
Part V Advanced Apache
14 Apache Under the Hood: Open Source and Security.........................305
15 Apache/SSL................................................................................337
16 Apache and Firewalls ..................................................................371
17 Apache and Ciphers....................................................................419
18 Hacking Homegrown Apache Modules...........................................431
00 067232380x fm 5/7/02 3:01 PM Page iv
Part VI Appendixes
A Apache Security-Related Modules and Directives..............................471
B Apache Security Advisories and Bugs..............................................505
C Apache Security Resources............................................................555
D Apache API Quick Reference.........................................................575
E Glossary....................................................................................597
Index.......................................................................................637
00 067232380x fm 5/7/02 3:01 PM Page v
Table of Contents
Introduction 1
Why Did I Write This Book?............................................................1
Why Apache Web Server?........................................................2
What This Book Will Tell You..........................................................4
System Requirements .....................................................................5
Absolute Requirements...........................................................5
Archiving Tools......................................................................5
Text and Typesetting Viewers...................................................6
Programming Languages.........................................................7
This Book’s Organization................................................................8
General Organization .............................................................8
Maximum Apache Security’s Developmental Features....................11
Part, Chapter, and Section Structure........................................12
About Examples in This Book.........................................................13
About Links and References in This Book.................................14
Summary....................................................................................16
Part I Getting Started
1 How Apache Handles Security 19
Generic HTTP Security Considerations.............................................19
Apache Security Facilities...............................................................23
Apache Web Server, Security, and Open Source..........................25
Apache Extensibility.....................................................................26
Apache’s Modular Design and the Apache API...........................27
Things Apache Can’t Defend Against...............................................29
Summary....................................................................................30
Part II Creating a Secure Apache Host Server
2 The Risks: Cracking Apache 33
Inherent Risks of Running a Web Server...........................................33
Sobering Statistics to Consider........................................................34
00 067232380x fm 5/7/02 3:01 PM Page vi
vi Maximum Apache Security
How Security Disasters Develop......................................................41
Intruders Gaining Simple Access.............................................41
Denial of Service..................................................................44
Defacement or Total System Seizure.........................................45
Other Services......................................................................48
Summary....................................................................................56
3 Establishing Minimum Server Security 57
Physical Security Concepts.............................................................57
Server Location and Physical Access................................................58
Network Topology........................................................................59
BIOS and Console Passwords..........................................................60
Media and Boot Security................................................................62
Biometric Identification: A Historical Perspective.......................63
Using Biometric Access Control Devices...................................65
Anti-Theft Devices........................................................................66
Unique Numbers, Marking, and Other Techniques.....................67
Summary....................................................................................68
4 Environmental Hazards: Apache and Your Operating System 69
Apache and Your Underlying Operating System................................69
Choosing Your Operating System............................................70
Why So Much Talk About Operating Systems?...........................73
Environmental Risks Common to Unix............................................75
Shells.................................................................................75
Unix’s Inherent Complexities.................................................78
Environmental Risks Common to Windows......................................79
Other Environmental Risks............................................................85
Summary....................................................................................85
5 Apache, Databases, and Security 87
Apache Database Support..............................................................87
Apache and Proprietary Databases...................................................88
Apache and MySQL......................................................................89
mod_mysql...........................................................................91
mod_mysql_include...............................................................91
PHP Modules.......................................................................91
Vulnerabilities in or Associated with MySQL.............................92
PostgreSQL..................................................................................95
00 067232380x fm 5/7/02 3:01 PM Page vii
Contents vii
Apache and Commercial SQL Packages............................................96
Apache and Oracle...............................................................96
Apache and Oracle Tools......................................................100
Apache and Informix..........................................................102
General Database Security Measures...............................................104
Summary..................................................................................106
Part III Hacking Apache’s Configuration
6 Apache Versions and Security 109
Brief History of Apache Versions...................................................109
Security Issues Common to Apache Releases...................................111
Patch Maintenance and Other Measures.........................................116
Starting with Flawed Software...............................................116
Transfer of Ownership or Employee Turnover..........................117
Network Trust Relationships.................................................117
Summary..................................................................................118
7 Version 2.0 IPv6 Support 119
What Is IPv6?............................................................................119
IPv6 and Security.......................................................................120
The IP Authentication Header Protocol...................................121
The IP Encapsulating Security Payload....................................122
Why Does Apache Support IPv6?..................................................125
Apache and IPv6 Addressing.........................................................125
IPv6 Basic Address Structure.................................................126
Types Of IPv6 Addresses.......................................................126
IPv6 Address Issues in Development..............................................128
IPv6 in Apache Source Code.................................................129
Papers and Resources on IPv6 Development............................130
Listen,NameVirtualHost, and VirtualHost....................................132
IPv6 Implementations.................................................................132
Summary..................................................................................134
8 Overlording Apache Server: General Administration 135
Permissions and Apache Server.....................................................135
Permissions and Ownership in Unix......................................136
Permissions and Ownership in Windows................................140
Summary on Permissions.....................................................142
00 067232380x fm 5/7/02 3:01 PM Page viii
viii Maximum Apache Security
URL Mapping and Security...........................................................143
mod_alias.........................................................................143
mod_rewrite......................................................................147
mod_userdir......................................................................155
mod_speling......................................................................157
Resource Usage ..........................................................................157
AcceptMutex......................................................................158
LimitRequestBody...............................................................159
LimitRequestFields...........................................................159
LimitRequestFieldsize.......................................................160
LimitRequestLine...............................................................160
RLimitCPU.........................................................................160
RLimitMEM.........................................................................160
RLimitNPROC......................................................................161
ThreadStackSize................................................................161
Apache Server Tools....................................................................161
ab(The Apache HTTP Server Benchmarking Tool)....................161
apachectl.........................................................................164
apxs.................................................................................164
suexec..............................................................................166
Summary..................................................................................168
9 Spotting Crackers: Apache Logging Facilities 169
What Is Logging, Exactly?............................................................169
How Apache Handles Logging......................................................170
ap_log_error.....................................................................170
ap_log_perror...................................................................170
ap_log_rerror...................................................................171
Other Apache Logging Functions and Facilities........................171
Apache Logging Routines and Hooks.....................................174
httpdLogs................................................................................175
access_log: The HTTP Access Log File....................................175
Settingerror_log’s Location and Log Levels...........................178
Some Security Caveats About Logs.................................................185
Piped Logs.................................................................................187
TheSetEnvIfDirective and Conditional Logging............................191
Other Interesting Apache-Related Logging Tools..............................193
mod_relocate.....................................................................193
mod_mylog.........................................................................194
00 067232380x fm 5/7/02 3:01 PM Page ix
Contents ix
mod_view...........................................................................194
mod_log_mysql...................................................................194
parselog...........................................................................195
Apache-DBILogConfig..........................................................195
Apache-DBILogger...............................................................195
Apache-DebugInfo...............................................................195
Apache-LogFile..................................................................196
Apache-ParseLog................................................................196
Apache-Wombat...................................................................196
Log-Dispatch.....................................................................196
Other Interesting Logging Tools Not Specific to Apache....................197
SWATCH (The System Watcher)............................................198
Watcher............................................................................198
NOCOL/NetConsole v4.0.....................................................199
PingLogger........................................................................199
LogSurfer...........................................................................199
Netlog..............................................................................199
Analog..............................................................................200
Summary..................................................................................200
Part IV Runtime Apache Security
10 Apache Network Access Control 203
What Is Network Access Control?..................................................203
How Apache Handles Network Access Control: Introducing
mod_access..............................................................................204
A Brief mod_accessTour.......................................................204
Using Network Access Control in Apache (httpd.conf).....................211
Inclusive Screening: Explicitly Allowing Authorized Hosts.........212
Exclusive Screening: Explicitly Blocking Unwanted Hosts..........214
Themutual-failureOption: Mix and Match..........................214
Access Control Based on Environment Variables......................215
Configuration Options That Can Affect Security......................218
TheExecCGIOption: Enabling CGI Program Execution.............218
TheFollowSymLinksOption: Allowing Users to Follow
Symbolic Links.................................................................219
TheIncludesOption: Enabling Server-Side Includes.................220
TheIndexesOption: Enabling Directory Indexing...................221
Virtual Hosts and Network Access Control......................................222
Summary..................................................................................223