Skip to main content

Straightforward security enhancements for your apache2 webserver

If, like me, you've got a scrappy Linux host lying around to run a few websites you're probably interested in taking its security up a notch from the standard install. Assuming you're running the highly common apache2 and iptables, see the links below for some surprisingly straightforward configuration tweaks to improve the security of your webserver.


Add HTTPS with Let's Encrypt

If it's been a while since you've looked into certificates, you may be surprised to learn you can get them for free from Let's Encrypt. There are many guides around, but it is well and truly time to join the HTTPS-only movement:
https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-18-04

SSH Cipher gardening

You're probably already using SSH keys, have disabled password login and are using denyhosts or failtoban. However, have you ever considered reducing the number of ciphers your server accepts to just the most secure? Test your server at: https://sshcheck.com/ and then update your SSHD config (see also: https://infosec.mozilla.org/guidelines/openssh)



HTTPS Header additions

There are a couple of decent free online test sites for webservers, such as those at SSLLabs, Pentest Tools or Immuniweb . One way to improve your score is to configure some extra HTTPS headers, using this guide.


DDoS Protection with IPTables

Have you already got your IPTables config to the point where you have a -j DROP catch all at the end? This guide is a true education in iptables, TCP and DDoS - follow its recommendations.

Application-Level firewall with Modsecurity

Your apache logs are likely full of obvious scans from botnets looking for an easy way in. Public webservers have to have the port open, but you can still block these requests at a higher level than your firewall. On Ubuntu 18.04:
sudo apt-get install libapache2-mod-security2 modsecurity-crs
sudo cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf
sudo sytstemctl restart apache2


and you'll install a powerful apache module (modsecurity) that has frequently updated patterns that match common exploit requests (OWASP Core Rule Set). Read all the options thoroughly, and when ready set it to block those requests.
Labels:

Comments

Post a Comment

Popular posts from this blog

The Story of LLRP2HRP - Part 2

So, this brash American dude who ran a relay race event decided to go fancy. None of this using phones to manually scan NFC chips for race timing. He was going to have chips in bibs. He convinced another organisation that also ran races to chip in some funding ... and then went online. He found an RFID reader system. The kind of ground mats that you run over, that connects to a box that goes beep. It was from China. It was insanely cheap. Like fall-off-the-back-of-a-truck cheap. It was delivered, hardware checks out. It came with no software. Last time , we'd figured out that it also provided RFID tag information using a proprietary binary protocol and were trying to lock down exactly what that was. It was one of the most arduous Google sessions I've had for a while. Trawling the entire web for some document or code that probably only existed inside an office in Shenzhen. But I found something! It was amazing, because of the source, and how perfectly it fit my n...
4 comments
Read more

How to transfer money from Taiwan without going to the bank

We live in a digital age. The Taiwanese banking system ... a little less so. Transferring money overseas typically involves a visit to the bank between 9am and 3pm. You'll queue, fill out an outbound remittance form in duplicate, stamp and sign some things and just generally wait while staff do their best with the unfamiliar procedure. There is another way.* * for transfers < 500,000 TWD, to accounts you've previously set up in a special way :(  Background: Remittance Classifications One of the reasons for the myriad of complicated forms when dealing with foreign exchange in Taiwan is the precise codification of transfer types required by the Central Bank. Your knowledge of the existence of these two documents will boost your standing above that of the average banker: 匯出匯款之分類及說明  Code and Description of Outward Remittance Classification 匯入匯款之分類及說明 Code and Description of Inward Remittance Classification These are updated every few years, with new versions fo...
Post a Comment
Read more

Marriage in Taiwan: Document Requirements - Registration

For most foreign residents, the process of getting married in Taiwan is a simple trip to the local household registration agency. If you have the right documents, you can be married in as little as fifteen minutes. This post is the most comprehensive list around of what you need to prepare. This post is part of a series on Marriage in Taiwan: Marriage in Taiwan: Document Requirements - the laws Marriage in Taiwan: Acquiring a Single Status Certificate from Australia Marriage in Taiwan: Document Requirements - Registration Documents required for a Foreign National and Taiwanese National to Register Marriage in Taiwan Original Single Status Certificate/Certificate of No Impediment to Marriage/Affidavit of Single Status, Authenticated and Legalised for use in Taiwan Certified Chinese Translation of the above certificate Passport (unconfirmed) Normally, the most recent entry stamp in your passport is checked. If you use eGate to enter the country, you may require a Certif...
Post a Comment
Read more