Professional Apache Security

Gianluca writes "Web sites get defaced every day -- that's routine practice for aspiring crackers who want to gain popularity by proving their bravery. Too often their attacks are aimed at unprepared, defenceless servers which were improperly secured by clumsy administrators. Just reading a book won't save you from the next cracker attack. However, having a solid knowledge of the basics of web security and a list of effective checkpoints for configuring your server, will definitely help you to prevent at least the most trivial mistakes." Gianluca reviews here Wrox Press' Professional Apache Security to see how well it can provide that kind of knowledge -- read on below. Professional Apache Security author Tony Mobily et al. pages 360 publisher Wrox Press rating 8.0 reviewer Gianluca Insolvibile ISBN 1861007760 summary A comprehensive overview of security related issues of interest for web admins, security analysts and web developers

The book walks through the most common tasks of an Apache administrator. It covers, for example, proper installation and maintenance, common practices in security and remote attacks. Some basic notions of system administration are also given, for those areas which affect the web server behaviour.

Topics of specific interest for security freaks include system hardening, intrusion detection mechanisms, monitoring and logging, server chroot()ing, session tracking, cryptography and SSL.

Throughout the book there are descriptions of common attacks like Cross-Site Scripting (XSS), CGI vulnerabilities, Denial of Service (DoS), Distributed DoS (DDoS), Reflection DDoS (RDDoS), cookie spoofing and session hijacking. Script kids be warned: there's no easily exploitable information on how to attack a web server inside the book.

What's to like
The book is well written, and an enjoyable read. It uses a very precise and yet friendly language to guide its readers through the covered subjects. Using this straightforward approach, it explains some thorny topics starting from basic notions and assuming no previous knowledge.

The explanation of essential topics like the HTTP protocol and server architecture, forms and CGI mechanisms, system configuration, etc. are nicely integrated with more tangled and scarcely documented issues. It is worth mentioning:

• the chapter on "jailing" the web server (which explains in detail how to correctly prepare a complete yet secure chroot'ed "sandbox" for Apache);
• the chapter on prevention of XSS attacks (explaining these types of attacks, and how to write CGI scripts to avoid them);
• the appendix dealing with usage and configuration of mod_rewrite.

Everything is supplemented with hands-on examples, information and tricks valuable to the intermediate reader; the clear explanations of basic topics will provide complete instructions for the beginners.

Further pro's of the book include updated information (issues related to Netscape 7, IE 6, Mozilla 1.0, Apache series 1.3 and 2.0), coverage of less known topics (e.g.: P3P) and a wealth of references to the relevant sources of information like RFCs, W3C specifications and CERT Advisories.

What's to consider
The downside of writing for both beginners and intermediate readers in just 360 pages is that the depth of the information provided is necessarily limited. The book is clearly targeted to less experienced system administrators, who will be able to quickly grasp the most important concepts revolving around Apache security and secure administration. Intermediate users are likely to find some paragraphs quite trivial, however they will be rewarded by the many pearls of wisdom offered in the more detailed sections. Expert system administrators might be disappointed by the lack of more in-depth and hard-core technical explanations.

The summary
The best aspect of the book is that it assembles basic notions, rarely available information and hints derived from the authors' experience to produce a neat, clearly written and comprehensive guide to Apache security. This will enable beginning web admins to understand the key points in managing and securing a web server, while providing experienced ones with a quick reference to the most important security practices.

Table of Contents
Introduction
Chapter 1: Installation
Chapter 2: Secure administration
Chapter 3: HTTP Security and Cross-Site Scripting Attacks
Chapter 4: Authentication and authorization
Chapter 5: System security
Chapter 6: Apache in jail
Chapter 7: Denial of service attacks
Chapter 8: Cookies
Chapter 9: CGI security
Chapter 10: Logging
Chapter 11: Session tracking
Chapter 12: Apache and cryptography
Chapter 13: SSL and Apache
Appendix A: Security resources
Appendix B: Apache with mod_rewrite
Appendix C: Sample SSL Accelerator implementations

You can purchase Professional Apache Security from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Comments

webapp side of the equation

[StandardDeviant]

The webapp side of the security equation is often sadly neglected by people focusing on the network and host levels of the system. (Which, don't get me wrong, are very important in their own rights.) It's nice to see a book that addresses "programmer-level" holes as well as "administrator-level" holes.

A very good site for (free) information on this area is http://www.owasp.org/. OWASP seems to mainly focus on webapp level security, which is ok given the wealth of informative resources out there for the host and network layer. (OWASP = Open Web Application Security Project)

Re:XSS

[William Fold]

Here's a good place to start:

http://www.cgisecurity.com/articles/xss-faq.shtm l

It's a start

[Kneht]

There's never gonna be a single source for all things security--even for a single item such as Apache. Those looking for a good start can go with this book, or google for how-to's, but another place is www.securityspace.com.

If you're running a web server, use my painfully-earned experience and never trust a single source to tell you you're secure. (This includes you. Get someone else to double-check your servers for you. Otherwise, you will never know what you missed until it's too late.)

kneht

Re:Not good enough.

[caferace]

Is there some kind of tool I can run (for free) that checks my system for vulnerabilities?

Try FreeScan from Qualys. Nice web based tool.

Re:When crackers attack!!

[t0c]

Actually... hackers are people who use clever techniques to improve code (or modify it for whichever purpose. The meaning of the word is usually a good one till society today dirtied it and made it "malicious people who break into servers") and programs in general. Now crackers are not the people who remove copyright protection...although the "cracking" of the program can be referred to as hacking code or whichever variation of the expression... Cracking is breaking into servers without prior consent from the owner or administrator. So the problem is not with semantics it's with what you (or should I say what most people) think a cracker and what a hacker or such things. A good knowledge of these things is never a bad thing.

Re:XSS

[Corporate Gadfly]

Be doubly nice and add a link, please.

http://www.cgisecurity.com/articles/xss-faq.shtml

web server security documentation

[Anonymous Coward]

www.cgisecurity.com/lib

Re:Stripping down

[mhesseltine]

Why bother, when other servers are several times simpler to set up, smaller and faster? Pheh!

Because, when the time comes that you need a feature that Apache provides, you just setup the module and restart Apache. Otherwise, you have to change your server setup from (insert odd other web server here) to Apache and go through all the setup steps anyway.

Or run a secure web server

[dmelomed]

http://cr.yp.to/publicfile.html