1
vote
1answer
45 views

My Server is returning a 404 instead of 403 when access if forbidden - is it good or bad?

via .htaccess, I forbid access to folders that have no index page inside (domain.com/images for example), and also block my site completely for several user-agents (such as wget). When I test to see ...
0
votes
1answer
26 views

Filtering content from response body HTML (mod_security or other WAFs)

We have Apache on Linux with mod_security as the Web App Firewall (WAF) layer. To prevent content injections, we have some rules that basically disable a page containing some text patterns from ...
0
votes
1answer
163 views

Password protecting dynamic URLs in Apache

I am handling many logical files request using the Apache server. To make the path simple I have used mod_rewrite in the httpd.conf. Now I am planning to enforce authentication on these logical file ...
1
vote
1answer
93 views

How to set up a single IP blocklist for multiple sites hosted on the same account

When running multiple sites on the same hosting account, one might find that an attacker has attempted to breach one site. A webmaster may want to block the IP address from all sites hosted in the ...
4
votes
2answers
152 views

Website hack resulting in auto redirect - where to start looking?

My website is being redirected to a non-existent page (/showpage.php) for some users when they hit the homepage. For other users, the site works fine. I have looked in the index.php files and some ...
2
votes
1answer
547 views

How to log username in Apache logs?

I need some help regarding how to log the user-name into apache logs. I'm building a use-case for Security Information Event Management. Is the method the same in case of IIS or just applicable to ...
5
votes
1answer
203 views

How to get rid of crawling errors due to the URL Encoded Slashes (%2F) problem in Apache

The Google web crawler has indexed a whole set of URLs with encoded slashes (%2F) for our site. I assume it has picked up the pages from our XML sitemap file. The problem is that the live pages will ...
2
votes
2answers
679 views

Is making my PHP files read-only a useful security measure?

Up until now I've been "protecting" my website's PHP files by making them read-only with chmod. Is this a useful security tactic? Or is it some "old wive's tale" and I'm wasting my time? I'm ...
1
vote
1answer
435 views

SSL on multiple directories

I have a website that is http, but has a port set up for https for a specific directory that is for the shopping cart. Now I'd like to use our SSL on a different directory in the same site as well. ...
2
votes
1answer
393 views

Tell apache to point to a subfolder as default starting point for public

What would be the different methods of telling Apache to serve up httpdocs/public instead of httpdocs as the default starting point? I want to be able to have my includes and logs directories behind ...
4
votes
1answer
166 views

Best way to protect public facing development environments?

We're in the process of setting up individualized dev environments for our developers. All of our developers are remote and we don't have a VPN or anything to bring this in house. But here's the ...
1
vote
1answer
198 views

www.foobar.com works but foobar.com results in a 'Server not found' error

I have just setup a minimal (hopefully secure? - comments welcome) apache website using the following configuration file: <VirtualHost *:80> ServerName foobar.com ServerAlias ...
5
votes
1answer
1k views

Why has Apache begun running a single process as root, and another as root and the wwwdata user?

I am running Apache Worker-MPM, PHP 5.3.2, and FCGID. Apache runs better than before, but I noticed that there is an apache process running as root and a second process that runs as both root and ...
2
votes
1answer
351 views

Configuring directory access on a server. .htaccess and alternatives?

I have written a small PHP package/site-template (should I say). It contains a directory data/ that contains some important files that the users should not be able to see. These file should however ...
1
vote
2answers
41 views

Blocking path scanning

I'm seeing in my access log a number of request very suspicious: /i /im /imaa /imag /image /images /images/d /images/di /images/dis They part from a known resource (in the above example ...
4
votes
6answers
760 views

Is it dangerous to keep Thumbs.db on a web server?

Windows Thumbs.db system files that are in most of folders were uploaded with all other files from the localhost to the server. Is it dangerous, if you forget to delete them on the server? I am on ...
1
vote
1answer
243 views

Apache <Directory> blocks

I'm trying to make it so that the outside world can't access a specific section of my website. What I did was: <Directory /Library/WebServer/.../secrets/> Order deny,allow Deny from ...
1
vote
2answers
506 views

How to block malicious requests before they reach Apache?

I have a RESTful web service that gets hit by a large number of requests coming from various IPs with dummy logins and random inputs. I have already denied these requests at the HTTP level (using the ...
9
votes
1answer
391 views

Why chmod 777 is not secure?

chmod 777 file change the permissions of the file file to read, write, and execute for all. Ok, so the file can be manipulated in any way by any script on the server. But why is this not ...
0
votes
1answer
126 views

Apache webserver user setup and security issues

I have a server running Centos 5.6/PHP/MySQL etc that will only host one website all the time. New question Is there any security implication on leaving a single website hosted in the default ...
2
votes
1answer
1k views

How do I save user uploaded files outside of the web folder but use them on my page?

I have read that one of the best things to do for security with user uploaded files is to store them outside of the web folder, as there is very little you can do to ensure that that jpg image the ...
4
votes
5answers
800 views

Site compromised .htaccess files everywhere

Some of the sites we're hosting are compromised by... I don't know what. Every directory on the webserver contains a .htaccess file which redirects a user coming from a search engine to a page which ...
4
votes
4answers
254 views

How to restrict access to my site using htaccess

How to disallow access to site except me?
1
vote
2answers
294 views

How can I allow robots access to my sitemap, but prevent casual users from accessing it?

I am storing my sitemaps in my web folder. I want web crawlers (Googlebot etc) to be able to access the file, but I don't necessarily want all and sundry to have access to it. For example, this site ...
7
votes
2answers
19k views

Can I skip the PEM pass phrase question when I restart the webserver?

After buying a multi-domain SSL certificate I have started testing it with the Nginx webserver (following documentation in their SSL wiki page). Everything is fine, it works and I get a green ...