Securing the Apache HTTP Server

The Apache HTTP Server is one of the most stable and secure services that ships with Red Hat Enterprise Linux 7. A large number of options and techniques are available to secure the Apache HTTP Server — too numerous to delve into deeply here. The following section briefly explains good practices when running the Apache HTTP Server.

Always verify that any scripts running on the system work as intended before putting them into production. Also, ensure that only the root user has write permissions to any directory containing scripts or CGIs. To do this, run the following commands as the root user:

chown root <directory_name> chmod 755 <directory_name>

System administrators should be careful when using the following configuration options (configured in

/etc/httpd/conf/httpd.conf): FollowSym Links

This directive is enabled by default, so be sure to use caution when creating symbolic links to the document root of the Web server. For instance, it is a bad idea to provide a symbolic link to /.

Indexes

This directive is enabled by default, but may not be desirable. To prevent visitors from browsing files on the server, remove this directive.

The UserDir directive is disabled by default because it can confirm the presence of a user account on the system. To enable user directory browsing on the server, use the following directives:

UserDir enabled

UserDir disabled root

These directives activate user directory browsing for all user directories other than /root/. To add users to the list of disabled accounts, add a space-delimited list of users on the UserDir

disabled line. ServerT okens

The ServerTokens directive controls the server response header field which is sent back to clients. It includes various information which can be customized using the following parameters:

ServerT okens Full (default option) — provides all available information (OS type and

used modules), for example:

Apache/2.0.41 (Unix) PHP/4.2.2 MyMod/1.2

ServerT okens Prod or ServerT okens ProductOnly — provides the following

information:

Apache

ServerT okens Major — provides the following information:

Apache/2

ServerT okens Minor — provides the following information:

Apache/2.0

ServerT okens Min or ServerT okens Minim al — provides the following information:

Apache/2.0.41

ServerT okens OS — provides the following information:

Apache/2.0.41 (Unix)

It is recommended to use the ServerTokens Prod option so that a possible attacker does not gain any valuable information about your system.

Important

Do not remove the IncludesNoExec directive. By default, the Server-Side Includes (SSI) module cannot execute commands. It is recommended that you do not change this setting unless absolutely necessary, as it could, potentially, enable an attacker to execute commands on the system.

Removing httpd Modules

In certain scenarios, it is beneficial to remove certain httpd modules to limit the functionality of the HTTP Server. To do so, simply comment out the entire line which loads the module you wish to remove in the

/etc/httpd/conf/httpd.conf file. For example, to remove the proxy module, comment out the

following line by prepending it with a hash sign:

#LoadModule proxy_module modules/mod_proxy.so

Note that the /etc/httpd/conf.d/ directory contains configuration files which are used to load modules as well.

httpd and SELinux

For information, see the Red Hat Enterprise Linux 7 SELinux User's and Administrator's Guide.

4.3.8. Securing FTP

The File Transfer Protocol (FTP) is an older TCP protocol designed to transfer files over a network. Because all transactions with the server, including user authentication, are unencrypted, it is considered an insecure protocol and should be carefully configured.

Red Hat Enterprise Linux 7 provides two FTP servers:

Red Hat Content Accelerator (tux) — A kernel-space Web server with FTP capabilities. vsftpd — A standalone, security oriented implementation of the FTP service.

The following security guidelines are for setting up the vsftpd FTP service.

4 .3.8.1. FTP Greeting Banner

Before submitting a username and password, all users are presented with a greeting banner. By default, this banner includes version information useful to crackers trying to identify weaknesses in a system. To change the greeting banner for vsftpd, add the following directive to the

/etc/vsftpd/vsftpd.conf file:

ftpd_banner=<insert_greeting_here>

Replace <insert_greeting_here> in the above directive with the text of the greeting message.

For mutli-line banners, it is best to use a banner file. To simplify management of multiple banners, place all banners in a new directory called /etc/banners/. The banner file for FTP connections in this example is

/etc/banners/ftp.m sg. Below is an example of what such a file may look like:

######### Hello, all activity on ftp.example.com is logged. #########

Note

It is not necessary to begin each line of the file with 220 as specified in Section 4.4.1, “Securing Services With TCP Wrappers and xinetd”.

To reference this greeting banner file for vsftpd, add the following directive to the

/etc/vsftpd/vsftpd.conf file:

banner_file=/etc/banners/ftp.msg

It also is possible to send additional banners to incoming connections using TCP Wrappers as described in Section 4.4.1.1, “TCP Wrappers and Connection Banners”.

4 .3.8.2. Anonymous Access

The presence of the /var/ftp/ directory activates the anonymous account.

The easiest way to create this directory is to install the vsftpd package. This package establishes a directory tree for anonymous users and configures the permissions on directories to read-only for anonymous users.

By default the anonymous user cannot write to any directories.

Warning

If enabling anonymous access to an FTP server, be aware of where sensitive data is stored.

4 .3.8.2.1. Anonymous Upload

To allow anonymous users to upload files, it is recommended that a write-only directory be created within

/var/ftp/pub/. To do this, run the following command as root:

~]# mkdir /var/ftp/pub/upload

Next, change the permissions so that anonymous users cannot view the contents of the directory:

~]# chmod 730 /var/ftp/pub/upload

A long format listing of the directory should look like this: ~]# ls -ld /var/ftp/pub/upload

drwx-wx---. 2 root ftp 4096 Nov 14 22:57 /var/ftp/pub/upload

Administrators who allow anonymous users to read and write in directories often find that their servers become a repository of stolen software.

Additionally, under vsftpd, add the following line to the /etc/vsftpd/vsftpd.conf file:

anon_upload_enable=YES 4 .3.8.3. User Accounts

Because FTP transmits unencrypted usernames and passwords over insecure networks for

authentication, it is a good idea to deny system users access to the server from their user accounts. To disable all user accounts in vsftpd, add the following directive to /etc/vsftpd/vsftpd.conf:

local_enable=NO

4 .3.8.3.1. Restricting User Accounts

To disable FTP access for specific accounts or specific groups of accounts, such as the root user and those with sudo privileges, the easiest way is to use a PAM list file as described in Section 4.2.1,

“Disallowing Root Access”. The PAM configuration file for vsftpd is /etc/pam.d/vsftpd.

It is also possible to disable user accounts within each service directly.

To disable specific user accounts in vsftpd, add the username to /etc/vsftpd/ftpusers

4 .3.8.4 . Use TCP Wrappers To Control Access

Use TCP Wrappers to control access to either FTP daemon as outlined in Section 4.4.1, “Securing Services With TCP Wrappers and xinetd”.