Apache is free and open source. Freedom, however, does not come with security out of the box.
Apache has gaps in its baseline security, and the variety of modules that can be installed on top of it makes it hard to fully guarantee the reliability of the system. This article walks you through several hardening techniques that will make your Apache less susceptible to web attacks.
Since Apache is a frequent target of attacks, we will start with a simple method that nevertheless makes your setup more complex should an attacker figure out your machine’s architecture.
If you host several sites under different domains, you already know the concept of a VirtualHost.
It consists of splitting the configuration into several files so each site’s configuration is independent.
For real separation between your sites, I recommend putting their document roots in different directories and avoiding any shared root between sites.
Suppose you host 5 sites (A, B, C, D, E). The simplest layout would be:
/var/www/
- ./A
- ./B
- ./C
- ./D
- ./E
It is already much cleaner to consider /var/www as the parent directory of the machine’s sites (here A).
Keep your virtualhosts separate and place them in /var/vhosts, which you have created beforehand. Since this layout is less common, it provides a small security benefit.
You already have an additional safeguard.
You can harden it further by relocating /var/vhosts and spreading its contents across several directories under /var.
Apache is very talkative, especially on 404, 403, and other errors. The file /etc/apache2/conf.d/security will help you keep it quiet.
First change, the ServerTokens. It hides the friendly greeting returned by HTTP queries: “Debian Jessie (Apache v 2.2.24)”. Recommended configuration:
ServerTokens Prod
Second change, ServerSignature. Setting it to Off hides the data cited above on Apache errors (403, 404, etc.).
ServerSignature Off