Tagged Questions
2
votes
1answer
80 views
How to log username in Apache logs?
I need some help regarding how to log the user-name into apache logs. I'm building a use-case for Security Information Event Management.
Is the method the same in case of IIS or just applicable to ...
3
votes
1answer
103 views
How to get rid of crawling errors due to the URL Encoded Slashes (%2F) problem in Apache
The Google web crawler has indexed a whole set of URLs with encoded slashes (%2F) for our site. I assume it has picked up the pages from our XML sitemap file. The problem is that the live pages will ...
2
votes
2answers
374 views
Is making my PHP files read-only a useful security measure?
Up until now I've been "protecting" my website's PHP files by making them read-only with chmod.
Is this a useful security tactic? Or is it some "old wive's tale" and I'm wasting my time?
I'm ...
1
vote
1answer
209 views
SSL on multiple directories
I have a website that is http, but has a port set up for https for a specific directory that is for the shopping cart. Now I'd like to use our SSL on a different directory in the same site as well. ...
2
votes
1answer
254 views
Tell apache to point to a subfolder as default starting point for public
What would be the different methods of telling Apache to serve up httpdocs/public instead of httpdocs as the default starting point?
I want to be able to have my includes and logs directories behind ...
4
votes
1answer
140 views
Best way to protect public facing development environments?
We're in the process of setting up individualized dev environments for our developers. All of our developers are remote and we don't have a VPN or anything to bring this in house.
But here's the ...
1
vote
1answer
172 views
www.foobar.com works but foobar.com results in a 'Server not found' error
I have just setup a minimal (hopefully secure? - comments welcome) apache website using the following configuration file:
<VirtualHost *:80>
ServerName foobar.com
ServerAlias ...
4
votes
1answer
802 views
Why has Apache begun running a single process as root, and another as root and the wwwdata user?
I am running Apache Worker-MPM, PHP 5.3.2, and FCGID.
Apache runs better than before, but I noticed that there is an apache process running as root and a second process that runs as both root and ...
2
votes
1answer
289 views
Configuring directory access on a server. .htaccess and alternatives?
I have written a small PHP package/site-template (should I say).
It contains a directory data/ that contains some important files that the users should not be able to see.
These file should however ...
1
vote
2answers
35 views
Blocking path scanning
I'm seeing in my access log a number of request very suspicious:
/i
/im
/imaa
/imag
/image
/images
/images/d
/images/di
/images/dis
They part from a known resource (in the above example ...
2
votes
5answers
465 views
Is it dangerous to keep Thumbs.db on a web server?
Windows Thumbs.db system files that are in most of folders were uploaded with all other files from the localhost to the server.
Is it dangerous, if you forget to delete them on the server?
I am on ...
1
vote
1answer
203 views
Apache <Directory> blocks
I'm trying to make it so that the outside world can't access a specific section of my website. What I did was:
<Directory /Library/WebServer/.../secrets/>
Order deny,allow
Deny from ...
1
vote
2answers
401 views
How to block malicious requests before they reach Apache?
I have a RESTful web service that gets hit by a large number of requests coming from various IPs with dummy logins and random inputs. I have already denied these requests at the HTTP level (using the ...
9
votes
1answer
292 views
Why chmod 777 is not secure?
chmod 777 file change the permissions of the file file to read, write,
and execute for all.
Ok, so the file can be manipulated in any way by any script on the server. But why is this not ...
0
votes
1answer
114 views
Apache webserver user setup and security issues
I have a server running Centos 5.6/PHP/MySQL etc that will only host one website all the time.
New question
Is there any security implication on leaving a single website hosted in the default ...
2
votes
1answer
793 views
How do I save user uploaded files outside of the web folder but use them on my page?
I have read that one of the best things to do for security with user uploaded files is to store them outside of the web folder, as there is very little you can do to ensure that that jpg image the ...
4
votes
5answers
668 views
Site compromised .htaccess files everywhere
Some of the sites we're hosting are compromised by... I don't know what.
Every directory on the webserver contains a .htaccess file which redirects a user coming from a search engine to a page which ...
3
votes
4answers
223 views
1
vote
1answer
218 views
How can I allow robots access to my sitemap, but prevent casual users from accessing it?
I am storing my sitemaps in my web folder. I want web crawlers (Googlebot etc) to be able to access the file, but I dont necessarily want all and sundry to have access to it.
For example, this site ...
3
votes
2answers
10k views
Can I skip the PEM pass phrase question when I restart the webserver?
After buying a multi-domain SSL certificate I have started testing it with the Nginx webserver (following documentation in their SSL wiki page).
Everything is fine, it works and I get a green ...
