IT Security Stack Exchange
IT Security Stack Exchange

Questions tagged [apache]

Questions about the security of Apache open source software, especially Apache HTTP Server

The Apache Software Foundation maintain a number of open source software, notably including the Apache HTTP Webserver -

Apache has been the most popular web server on the Internet since April of 1996.

http://www.apache.org/

519 questions
23
votes
1 answer

Received "md5" in access logs

In our Apache server we have received around 200 HTTP GET requests from the same IP and a common string in each request is "md5",…
Pawan Patil
  • 387
  • 3
  • 11
22
votes
8 answers

Should a site have SSL if it doesn't have a login form?

We have a site at work that is used for the following: Our homepage, which is just some info and contact info. Job applications are also handled on our site. There is no place where you can login though. I told management, seeing that we are a…
MyMichelle
  • 221
  • 2
  • 3
19
votes
3 answers

How can I block an IP, if I'm getting many http requests in a second?

If some one tried force burst attack on my website, how can I block them? Ideally, I want to block an IP if I have many http/Apache requests in a second.
lee peat
  • 201
  • 1
  • 2
  • 4
18
votes
6 answers

How safe is it to install XAMPP on my home computer to test PHP code?

I want to test some PHP code and I figure the best way is to install XAMPP - but I'm nervous about installing server software on my home computer. Is it generally safe to install XAMPP (given that I haven't done it before and don't have a lot of…
Frost
  • 181
  • 1
  • 1
  • 3
18
votes
2 answers

PHP attack string in access logs

So one of the Invision Power Board installations on my server was recently compromised. I found what seemed to be the attack (using PHP in the query string and carefully crafted cookies), and I blocked URL strings with PHP tags in the query…
Brandon Wamboldt
  • 283
  • 1
  • 8
18
votes
5 answers

Stop large requests to my server (TOR)

I am being attacked right now from Tor nodes which are doing 404 requests to my HTTP server. It is from one IP but when i use the DROP iptables rule, it starts again from another IP in a matter of seconds. It started to ask requests to the cgi-bin…
Alex
  • 181
  • 1
  • 6
16
votes
1 answer

Current State of BREACH (GZIP SSL Attack)?

It has been one year since BREACH made our way into our hearts, and there does not seem to be any articles or posts or patches since then, is my Google-fu weakening? Has BREACH been mitigated or patched in Apache/nginx? Can we enable GZIP on SSL if…
jnovack
16
votes
4 answers

Is displaying what server I am running on the error pages a security risk?

I just noticed that my 403 Forbidden (the default, not a custom one) page displays some server info: Apache/2.2.3 (Red Hat) Server at ... Port 80 Is revealing this information a security risk?
JD Isaacks
  • 365
  • 2
  • 8
15
votes
4 answers

(How) Can outsiders discover the pages that are being hosted on my server?

I have a web site hosted from my server. Sometimes, I upload database manipulation scripts to a folder which is three levels deep in the website and run them using my web browser. These scripts should not be accessed by outside users and I remove…
Hoytman
  • 493
  • 1
  • 6
  • 10
15
votes
4 answers

Can .htaccess and .htpasswd really protect me?

I want to set up a kind of personal wiki where I can store various sensitive information. However to make it 100% portable and and just plain convineant, I want to put it on the Internet. I'm sure at this point many of you are like "JESUS NO! ARE…
n0pe
  • 403
  • 1
  • 4
  • 9
14
votes
2 answers

Security implications of having files owned by the apache user?

Currently running a LAMP instance that developers are using for a variety of webapps. I have the following scenario: Multiple developers need access to create and modify files under /var/www/html The developers need to be able to access each…
am4
  • 141
  • 1
  • 3
14
votes
3 answers

How can I explain to the client that rfc2385 TCP MD5 Checksums can't be turned on for linux webservers?

I've had a long running conversation with a client where they perform a Rapid7 security scan which then warns about TCP MD5 checksums missing on port 80. This is what I think I know: RFC 2385 was designed to protect BGP, and by extension BGP-type…
Kit Sunde
  • 241
  • 2
  • 7
14
votes
2 answers

Protect against POST //cgi-bin/php attacks?

I am being attacked with this cgi injection: POST …
PiTheNumber
  • 5,394
  • 4
  • 19
  • 36
14
votes
1 answer

Determining httpd PHP Scripts with Auditd

Background I have an issue on my server where some hole is allowing malicious PHP files to be written to any world-writable directories beneath the web root. It is not currently causing any harm, as I have all these directories blocked from serving…
user112461
13
votes
2 answers

How to secure a ActiveMQ?

Does anybody have experience with securing/hardening ActiveMQ? Check lists or guides would be welcome.
AaronS
  • 2,575
  • 5
  • 22
  • 26
1
2
3
…
34 35