HTTPd
Note: This page is quite old and is likely out of date. My opinions may have also changed dramatically since this was written. It is here as a reference until I get around to updating it.
Apache or httpd is a strong and well tested webserver.
Installation
To install the Apache web server for this hardening guide on fedora run the following command as root:
[root@localhost] ~# yum install httpd mod_evasive mod_gnutls mod_security \
mod_selinux -y
A few modules I need to look into (TODO):
mod_log_post
Security Notes
Apache starts up using root privileges initially. Dropping the privileges is highly recommended as soon as possible (which it does if alternative credentials are supplied in it's configuration).
Additionally, the Apache web server can be used to remotely execute dynamic code if a vulnerability is found with the privileges the process is running as. This could be very dangerous... The languages allowed to be executed should be chosen wisely and hardened appropriately.
User credentials can be passed through the web server so it is strongly recommended that SSL certificates be used. If SSL certificates are available there are very few reasons not to use SSL everywhere.
The only exception I have been able to come up with is for an application that is extremely latency sensitive, contains no sensitive data, and have the data verified in a different way (through data signatures like HMAC or GPG). The latter is not necessarily required.
Firewall Adjustments
By default Apache only runs on port 80 using TCP, if SSL is enabled it will also use port 443 over SSL. Additional ports can be configured by the admin.
-A SERVICES -m tcp -p tcp --dport 80 -j ACCEPT
-A SERVICES -m tcp -p tcp --dport 443 -j ACCEPT
This service is very sensitive to the flood attack rules. It is recommended these be adjusted to allow twice the maximum number of connections expected during a time frame or alternatively to allow traffic on these two ports too bypass the anti-flood rules.
Performance Notes
If you use mod_security you should note that in my testing each Apache thread
increases it's resident memory size by ~27Mb using the stock configuration. For
servers that need to handle a high volume of requests this may not be
acceptable. If using mod_security you DEFINITELY need to adjust the
ServerLimit and MaxClients (they are aliases of each other so should always
be the same).
Tuning ServerLimit/MaxClients with the worker MPM
- Start up the apache server
- Use the
psutility to determine the size of client threads (will be in Kb) - Determine that max amount of RAM the apache process should be allowed to use
- Subtract the
parentprocesses RAM from that - Divide the remaining RAM by the size of the client threads, this is your ServerLimit / MaxClient value
An example of this is provided below:
[root@localhost ~]# /etc/init.d/httpd start
Starting httpd: [ OK ]
[root@localhost ~]# ps aux -u apache | grep httpd
root 2238 0.7 0.4 177132 9312 ? Ss 10:45 0:00 /usr/sbin/httpd
apache 2240 0.0 0.2 177132 5124 ? S 10:45 0:00 /usr/sbin/httpd
apache 2241 0.0 0.2 177132 5124 ? S 10:45 0:00 /usr/sbin/httpd
apache 2242 0.0 0.2 177132 5124 ? S 10:45 0:00 /usr/sbin/httpd
apache 2243 0.0 0.2 177132 5124 ? S 10:45 0:00 /usr/sbin/httpd
apache 2244 0.0 0.2 177132 5124 ? S 10:45 0:00 /usr/sbin/httpd
apache 2245 0.0 0.2 177132 5124 ? S 10:45 0:00 /usr/sbin/httpd
apache 2246 0.0 0.2 177132 5124 ? S 10:45 0:00 /usr/sbin/httpd
apache 2247 0.0 0.2 177132 5124 ? S 10:45 0:00 /usr/sbin/httpd
root 2249 0.0 0.0 103376 832 pts/0 S+ 10:45 0:00 grep --color=auto httpd
[root@localhost ~]# PARENTMEMORY=$((9312/1024))
[root@localhost ~]# CHILDMEMORY=$((5124/1024))
[root@localhost ~]# APACHERAM=1024
[root@localhost ~]# echo $(($(($APACHERAM-$PARENTMEMORY))/$CHILDMEMORY))
203
The parent process will have a running user of 'root', all of the children processes will have 'apache'. In the above example the parent process is using 9312Kb of memory or ~9Mb, the child process is using 5124Kb or ~5Mb, and we're allowing Apache to use up to 1Gb of memory (1024Mb). With that knowledge we can see that we should set ServerLimit and MaxClients to "203" each.
Configuration
/etc/httpd/conf/httpd.conf
This is the main configuration file. This differs quite a bit from the configuration files that come with most distributions, most notably most of the modules are disabled and sections of the config are only applicable if certain modules are loaded. This preserves compatibility with any functionality I may need in the future while removing the bloat of the modules.
To use this configuration you'll need to create the directory
/var/www/html/default. Any additional domains should be created in
/var/www/html with their domain name as the folder name.
### Section 1: Global Environment
ServerTokens Prod
ServerRoot "/etc/httpd"
PidFile run/httpd.pid
Timeout 60
KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 5
<IfModule prefork.c>
StartServers 8
MinSpareServers 5
MaxSpareServers 20
ServerLimit 256
MaxClients 256
MaxRequestsPerChild 5000
</IfModule>
# This isn't used by default in Fedora but can be by adjusting
# /etc/sysconfig/httpd
<IfModule worker.c>
StartServers 4
MaxClients 300
MinSpareThreads 25
MaxSpareThreads 75
ThreadsPerChild 25
MaxRequestsPerChild 0
</IfModule>
Listen 80
# Use to restrict by IP Address/Range
LoadModule authz_host_module modules/mod_authz_host.so
# Logging Modules
LoadModule log_forensic_module modules/mod_log_forensic.so
LoadModule log_config_module modules/mod_log_config.so
LoadModule logio_module modules/mod_logio.so
# Allow sending and detecting of mime types
LoadModule mime_module modules/mod_mime.so
# Header magic and compression
LoadModule headers_module modules/mod_headers.so
LoadModule expires_module modules/mod_expires.so
LoadModule deflate_module modules/mod_deflate.so
# Provides DirectoryIndex directive
LoadModule dir_module modules/mod_dir.so
# Disable if you don't need directory indexes
LoadModule autoindex_module modules/mod_autoindex.so
# Used by most MVC stuff
LoadModule rewrite_module modules/mod_rewrite.so
#LoadModule env_module modules/mod_env.so
#LoadModule setenvif_module modules/mod_setenvif.so
#LoadModule auth_basic_module modules/mod_auth_basic.so
#LoadModule authn_file_module modules/mod_authn_file.so
#LoadModule authn_alias_module modules/mod_authn_alias.so
#LoadModule authn_dbm_module modules/mod_authn_dbm.so
#LoadModule authn_default_module modules/mod_authn_default.so
#LoadModule authz_user_module modules/mod_authz_user.so
#LoadModule authz_owner_module modules/mod_authz_owner.so
#LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
#LoadModule authz_dbm_module modules/mod_authz_dbm.so
#LoadModule authz_default_module modules/mod_authz_default.so
#LoadModule mime_magic_module modules/mod_mime_magic.so
#LoadModule vhost_alias_module modules/mod_vhost_alias.so
#LoadModule alias_module modules/mod_alias.so
#LoadModule cache_module modules/mod_cache.so
#LoadModule disk_cache_module modules/mod_disk_cache.so
#LoadModule ext_filter_module modules/mod_ext_filter.so
#LoadModule usertrack_module modules/mod_usertrack.so
#LoadModule dav_module modules/mod_dav.so
#LoadModule dav_fs_module modules/mod_dav_fs.so
#LoadModule actions_module modules/mod_actions.so
#LoadModule speling_module modules/mod_speling.so
#LoadModule suexec_module modules/mod_suexec.so
#LoadModule cgi_module modules/mod_cgi.so
#LoadModule ldap_module modules/mod_ldap.so
#LoadModule auth_digest_module modules/mod_auth_digest.so
#LoadModule authn_anon_module modules/mod_authn_anon.so
#LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
#LoadModule userdir_module modules/mod_userdir.so
#LoadModule status_module modules/mod_status.so
#LoadModule include_module modules/mod_include.so
#LoadModule info_module modules/mod_info.so
#LoadModule negotiation_module modules/mod_negotiation.so
#LoadModule proxy_module modules/mod_proxy.so
#LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
#LoadModule proxy_http_module modules/mod_proxy_http.so
#LoadModule proxy_connect_module modules/mod_proxy_connect.so
#LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
#LoadModule cern_meta_module modules/mod_cern_meta.so
#LoadModule asis_module modules/mod_asis.so
#LoadModule unique_id_module modules/mod_unique_id.so
Include conf.d/*.conf
<IfModule status_module>
ExtendedStatus Off
</IfModule>
User apache
Group apache
### Section 2: 'Main' server configuration
ServerAdmin [email protected]
UseCanonicalName Off
DocumentRoot "/var/www/html/default"
<Directory />
Options FollowSymLinks
AllowOverride None
Order Deny,Allow
Deny from all
</Directory>
<Directory "/var/www/html">
# Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
Options Indexes SymLinksifOwnerMatch
AllowOverride FileInfo AuthConfig Limit
Order allow,deny
Allow from all
</Directory>
<IfModule mod_userdir.c>
# This module won't get loaded unless we want to use it so we should
# make sure that it's properly configured
UserDir disabled root
UserDir public_html
<Directory /home/*/public_html>
AllowOverride AuthConfig Limit
Options Indexes SymLinksIfOwnerMatch
<Limit GET POST>
Order allow,deny
Allow from all
</Limit>
<LimitExcept GET POST>
Order deny,allow
Deny from all
</LimitExcept>
</Directory>
</IfModule>
DirectoryIndex index.html
AccessFileName .htaccess
<Files ~ "^\.ht">
Order allow,deny
Deny from all
</Files>
TypesConfig /etc/mime.types
DefaultType text/plain
<IfModule mod_mime_magic.c>
MIMEMagicFile conf/magic
</IfModule>
HostnameLookups Off
# Disable these if we need to serve files from NFS
EnableMMAP On
EnableSendfile On
ErrorLog logs/error_log
LogLevel warn
LogFormat "%v %h %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" \"%{forensic-id}n\" %I %O %T" combined
LogFormat "%v %h %t \"%r\" %>s %b" common
LogFormat "%v %{Referer}i -> %U" referer
LogFormat "%v %{User-agent}i" agent
CustomLog logs/access_log combined
ForensicLog logs/forensic_log
ServerSignature Off
<IfModule mod_dav_fs.c>
DAVLockDB /var/lib/dav/lockdb
</IfModule>
<IfModule autoindex_module>
Alias /icons/ "/var/www/icons/"
<Directory "/var/www/icons">
Options SymLinksIfOwnerMatch
AllowOverride None
Order allow,deny
Allow from all
</Directory>
IndexOptions FancyIndexing VersionSort NameWidth=* HTMLTable Charset=UTF-8
AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip
AddIconByType (TXT,/icons/text.gif) text/*
AddIconByType (IMG,/icons/image2.gif) image/*
AddIconByType (SND,/icons/sound2.gif) audio/*
AddIconByType (VID,/icons/movie.gif) video/*
AddIcon /icons/binary.gif .bin .exe
AddIcon /icons/binhex.gif .hqx
AddIcon /icons/tar.gif .tar
AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv
AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip
AddIcon /icons/a.gif .ps .ai .eps
AddIcon /icons/layout.gif .html .shtml .htm .pdf
AddIcon /icons/text.gif .txt
AddIcon /icons/c.gif .c
AddIcon /icons/p.gif .pl .py
AddIcon /icons/f.gif .for
AddIcon /icons/dvi.gif .dvi
AddIcon /icons/uuencoded.gif .uu
AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
AddIcon /icons/tex.gif .tex
AddIcon /icons/bomb.gif core
AddIcon /icons/back.gif ..
AddIcon /icons/hand.right.gif README
AddIcon /icons/folder.gif ^^DIRECTORY^^
AddIcon /icons/blank.gif ^^BLANKICON^^
DefaultIcon /icons/unknown.gif
AddDescription "GZIP compressed document" .gz
AddDescription "tar archive" .tar
AddDescription "GZIP compressed tar archive" .tgz
AddDescription "BZIP2 compressed tar archive" .tar.bz2
ReadmeName README.html
HeaderName HEADER.html
IndexIgnore .??* *~ *# HEADER* README* RCS CVS *,v *,t
</IfModule>
AddDefaultCharset UTF-8
# Compressed
AddType application/x-tar .tgz
AddType application/x-compress .Z
AddType application/x-gzip .gz .tgz
# Certificates
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl
# Audio
AddType audio/ogg oga ogg
# Video
AddType video/ogg ogv
AddType video/mp4 mp4
AddType video/webm webm
# SVG
AddType image/svg+xmlsvg svgz
AddEncoding gzip svgz
# Web Fonts
AddType application/vnd.ms-fontobject eot
AddType font/truetype ttf
AddType font/opentype otf
AddType application/x-font-woff woff
# Assorted
AddType image/x-icon ico
AddType image/webp webp
AddType text/cache-manifest appcache manifest
AddType text/x-component htc
AddType application/x-chrome-extension crx
AddType application/x-xpinstall xpi
AddType application/octet-stream safariextz
# Add a bunch of compression directives
<IfModule mod_deflate.c>
# 0 - 9 CPU/Bandwidth tradeoff
DeflateCompressionLevel 7
<IfModule mod_setenvif.c>
<IfModule mod_headers.c>
SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s,?\s(gzip|deflate)?|X{4,13}|~{4,13}|-{4,13})$ HAVE_Accept-Encoding
RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding
</IfModule>
</IfModule>
# html, txt, css, js, json, xml, etc:
<IfModule filter_module>
FilterDeclare COMPRESS
FilterProvider COMPRESS DEFLATE resp=Content-Type /text/(html|css|javascript|plain|x(ml|-component))/
FilterProvider COMPRESS DEFLATE resp=Content-Type /application/(javascript|json|xml|x-javascript)/
FilterChain COMPRESS
FilterProtocol COMPRESS change=yes;byteranges=no
</IfModule>
# webfonts and svg:
<FilesMatch "\.(ttf|otf|eot|svg)$" >
SetOutputFilter DEFLATE
</FilesMatch>
</IfModule>
<IfModule mod_include>
AddType text/html .shtml
AddOutputFilter INCLUDES .shtml
</IfModule>
#ErrorDocument 500 "The server just diagnosed itself with schizophrenia."
#ErrorDocument 404 /missing.html
#ErrorDocument 404 "/cgi-bin/missing_handler.pl"
#ErrorDocument 402 http://www.example.com/subscription_info.html
<IfModule mod_setenvif>
BrowserMatch "Mozilla/2" nokeepalive
BrowserMatch "MSIE 4\.0b2;" nokeepalive downgrade-1.0 force-response-1.0
BrowserMatch "RealPlayer 4\.0" force-response-1.0
BrowserMatch "Java/1\.0" force-response-1.0
BrowserMatch "JDK/1\.0" force-response-1.0
BrowserMatch "Microsoft Data Access Internet Publishing Provider" redirect-carefully
BrowserMatch "MS FrontPage" redirect-carefully
BrowserMatch "^WebDrive" redirect-carefully
BrowserMatch "^WebDAVFS/1.[0123]" redirect-carefully
BrowserMatch "^gnome-vfs/1.0" redirect-carefully
BrowserMatch "^XML Spy" redirect-carefully
BrowserMatch "^Dreamweaver-WebDAV-SCM1" redirect-carefully
</IfModule>
<IfModule status_module>
<Location /server-status>
SetHandler server-status
Order deny,allow
Deny from all
Allow from 10.13.37.
</Location>
</IfModule>
<IfModule info_module>
<Location /server-info>
SetHandler server-info
Order deny,allow
Deny from all
Allow from 10.13.37.
</Location>
</IfModule>
<IfModule mod_proxy>
ProxyRequests On
ProxyVia Block
<Proxy *>
Order deny,allow
Deny from all
Allow from 10.13.37.
</Proxy>
<IfModule mod_disk_cache.c>
CacheEnable disk /
CacheRoot "/var/cache/mod_proxy"
</IfModule>
</IfModule>
/etc/httpd/conf.d/php.conf
This file is being included here as it will be needed most places that I run Apache. Please refer to the PHP section below for more information.
<IfModule prefork.c>
LoadModule php5_module modules/libphp5.so
</IfModule>
<IfModule worker.c>
LoadModule php5_module modules/libphp5-zts.so
</IfModule>
AddHandler php5-script .php
AddType text/html .php
AddType application/x-httpd-php-source .phps
DirectoryIndex index.php
/etc/httpd/conf.d/mod_evasive.conf
mod_evasive is a crafty little module designed to limit the impact of DoS and
DDoS attacks. This won't stop them but it will help defend against them. It
will also send notices to an admin if desired (it's an optional feature which
can be disabled).
The one potential problem I can see cropping up is with AJAX requests. Those can come in fast and hard, and they are intentional and necessary, if that becomes a problem (you'll get a 403 response when you trip and it will last for DOSBlockingPeriod seconds) then play with the DOSPageCount setting and the DOSSiteCount setting. Alternatively you can just program your AJAX clients to understand what happened and to react accordingly.
LoadModule evasive20_module modules/mod_evasive20.so
<IfModule mod_evasive20.c>
DOSHashTableSize 3097
DOSPageCount 2
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 10
#DOSEmailNotify [email protected]
DOSLogDir "/var/lock/mod_evasive"
#DOSWhitelist 192.168.0.*
</IfModule>
/etc/httpd/conf.d/mod_gnutls.conf
The GnuTLS module provides SSL encryption for web requests. It's quite a bit
more flexible than mod_ssl though it hasn't been audited as thoroughly. It is
also considered an 'experimental' module for apache even though it's been in
the wild for two years.
LoadModule gnutls_module modules/mod_gnutls.so
GnuTLSCache dbm "/var/cache/mod_gnutls"
GnuTLSCacheTimeout 300
Listen 443
/etc/httpd/conf.d/mod_security.conf
WARNING: While this is a good module to have loaded it sextuples the amount of memory used by child processes. You will need to tune the server's performance settings accordingly. This may have a huge impact on high-traffic sites.
With that out of the way this is a very good application firewall to have as
part of the defense-in-depth doctrine, though it's configuration can be a
burden. The mod_security module gives your Apache Web server increased
ability to inspect and process input from Web clients before it's acted on by
the scripts or processes waiting for the input.
The mod_security module even lets you inspect Web server output before it's
transmitted back to clients. I love this feature: it allows you to watch out
for server responses that might indicate that other filters have failed and an
attack has succeeded!
With that said this isn't the file you should actually be looking at. Yes this
is where everything will get loaded but the stock Fedora mod_security for the
most parts loads up mod_security rules in other places including the Core
ModSecurity Rule Set which will get updated with the rest of your server.
The variables that you'll want to play around with are located in
/etc/httpd/modsecurity.d/modsecurity_crs_10_config.conf and if you want to
write your own rules in /etc/httpd/modsecurity.d/modsecurity_localrules.conf.
Some changes I'd recommend in
/etc/httpd/modsecurity.d/modsecurity_crs_10_config.conf:
- Uncomment the rule that limits argument name length to 100 characters
- Uncomment the rule that limits the value of an argument's length to 400 characters
- Uncomment the rule that limits the total argument length to 64000 characters
- Review the restricted extension types
After keeping an eye on the logs for a few weeks and ensuring that there aren't
any false positives, you should change the line SecDefaultAction "phase:2,pass to SecDefaultAction "phase:2,deny,log,status:403".
/etc/httpd/conf.d/mod_selinux.conf
The mod_selinux module allows us to extend SELinux contexts into individual
web applications or virtual hosts without impacting the memory usage of
individual child processes (The parent process seems to use about 100Kb of
memory more but this is negligible).
Since I don't use the built in apache authentication I'm limited to restrictions based on virtual hosts, which is still a rather large gain of security.
You can additionally adjust contexts based on the IP the user is connecting from.
LoadModule selinux_module modules/mod_selinux.so
selinuxServerDomain *:s0
selinuxDomainEnv SELINUX_DOMAIN
If you enable the environment module (env_module) in apache the domain may be
available for use within the application (it would be SELINUX_DOMAIN). This
hasn't been tested. With PHP you may need to add the E to the string
variable_order, and adjust auto_globals_jit in the php.ini file.
Changing contexts with the stock SELinux rules is denied! You will need to create a SELinux policy to allow it.
Virtual Host Contexts
To make use of this feature you need to define contexts within each of the
virtual host configuration directives after enabling mod_selinux by adding
the following line:
selinuxDomainVal *:s0:c1
The trailing domain should be different for virtual host (the next one would be c2).
IP Based Contexts
You can set contexts based on the IP address being connected from by adding the following line within a Directory definition:
SetEnvIf Remote_Addr "10.13.37.(25[0-5]|2[0-4][0-9]|[1-9]?[0-9])$" SELINUX_DOMAIN=*:s0:c1
/etc/httpd/conf.d/virtual_hosts.conf
This does not exist upon the default installation and will need to be created. No certificates are automatically generated when you install the GnuTLS module, if you need them you will need to generate them yourself.
NameVirtualHost *:80
<IfModule gnutls_module>
NameVirtualHost *:443
# Redirect all unencrypted connections which haven't been defined to the secure ones
<VirtualHost _default_:80>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
</VirtualHost>
</IfModule>
<VirtualHost _default_:443>
GnuTLSEnable On
GnuTLSPriorities SECURE
GnuTLSCertificateFile /etc/pki/tls/certs/localhost.crt
GnuTLSKeyFile /etc/pki/tls/private/localhost.key
</VirtualHost>
<VirtualHost *:443>
ServerName something.example.org
GnuTLSEnable On
GnuTLSPriorities SECURE
GnuTLSCertificateFile /etc/pki/tls/certs/something.example.org.crt
GnuTLSKeyFile /etc/pki/tls/private/something.example.org.key
DocumentRoot "/var/www/html/something.example.org"
</VirtualHost>
/etc/httpd/conf.d/welcome.conf
Delete this file, it has no use and should be removed.
Virtual Hosts
Please note that name based virtual hosts are not supported on SSL connections
when using mod_ssl. They work quite well with mod_gnutls and browsers that
support SNI (Server Name Indication, as described in section 3.1 of
RFC3546). Compatibility with older browsers may be impacted.
Name Based
Name based virtual hosts allow you to re-use an IP to host multiple websites.
This is only officially supported for unencrypted connections, however by using
the GnuTLS module you can easily set this up with SSL based hosts as well. An
example of how to use this can be seen in the virtual_hosts.conf file on this
page.
IP Based
I don't really use these so I'm not including documentation, this section is mostly so other people referencing this documentation can be aware that they can have different virtual hosts bound to specific IP addresses rather than hostnames.
PHP
[root@localhost] ~# yum install php php-suhosin
Additional PHP packages that may be needed and that I've found very useful:
- php-mcrypt
- php-bcmath
- php-ldap
- php-snmp
- php-pdo
- php-mysql
- php-pecl-xdebug
/etc/php.ini
The following is for production use, display_errors,
display_startup_errors, mysql.trace_mode may be useful in development.
| |
/etc/php.d/suhosin.ini
This is the config file for the suhosin extension. If an application isn't working check the logs generated by suhosin to see if it is the issue.
extension = suhosin.so
[suhosin]
suhosin.log.syslog.facility = LOG_LOCAL2
suhosin.executor.max_depth = 15
suhosin.executor.include.max_traversal = 2
suhosin.executor.disable_eval = On
suhosin.executor.disable_emodifier = On
suhosin.mail.protect = 2
suhosin.session.cryptraddr = 2
suhosin.cookie.cryptraddr = 2
; This is not an official response, just funny :D
suhosin.filter.action = 418
suhosin.upload.disallow_elf = On
Basic Authentication
Sometimes it's just needed to prevent access to something for a little while,
HTTP basic authentication can help! If you're using the hardened configuration
above you'll need to enable a few modules to actually use it and make sure that
a .htaccess file has permission to override AuthConfig. Add the following
lines if they aren't already there in the section where you load modules:
LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule authn_file_module modules/mod_authn_file.so
LoadModule authz_user_module modules/mod_authz_user.so
Additionally if you want to use group based authentication add:
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
First create a user to use for the login:
htpasswd -c .htpasswd demouser
Additional users can be added by omitting the -c.
Create or append the following to a .htaccess file in the directory you want
to protect:
AuthType Basic
AuthName "Some Name Describing the site"
AuthUserFile /path/to/.htpasswd
Require valid-user
That's it you'll have HTTP Basic authentication. If you want to use a group
file you'll need to change the setting in the .htaccess file to match:
AuthType Basic
AuthName "Some Name Describing the site"
AuthUserFile /path/to/.htpasswd
AuthGroupFile /path/to/.htgroups
Require group demogroup
And create a group file .htgroups with the following:
demogroup: demouser someotheruser
Kerberos Authentication
http://www.grolmsnet.de/kerbtut/
Passenger
Before going through this you need to ensure that the tools for compiling ruby are installed on the system these are listed in Ruby.
Ensure that ruby is installed on the system as well as the development headers needed to compile the passenger module, this is all done as root:
yum install ruby curl-devel ruby-devel httpd-devel apr-devel apr-util-devel -y
gem install passenger
passenger-install-apache2-module
I wasn't able to get this working at the current time as there is a bug in passenger 3.0.12 that prevents it from being compiled with GCC 4.6.
e0ae306a @ 2024-07-15