Apache HTTP Server Security Configuration Guide (Latest Recommendation)

introduction

With the development of the Internet, web servers are facing more and more security threats. As one of the most widely used web servers, Apache's secure configuration is crucial. This article will explore how to enhance Apache's security through a series of measures, including configuring SSL/TLS, setting up access control, preventing common attacks, etc.

1. Update and Maintenance

Stay up to date: Periodically check and update Apache and its modules to the latest version to fix known vulnerabilities.
Minimize installation: Only install necessary modules and services to reduce potential attack surface.

2. SSL/TLS encryption

Enable HTTPS: Use SSL certificates to provide encrypted connections to the website to protect the security of user data transmission.
Choose a strong encryption kit: Configure the supported TLS version and cipher suite, and disable unsafe protocols (such as SSLv3).

&lt;VirtualHost *:443&gt;
    ServerName 
    DocumentRoot /var/www/html
    SSLEngine on
    SSLCertificateFile /path/to/
    SSLCertificateKeyFile /path/to/
    # Disable weak password suite    SSLCipherSuite HIGH:!aNULL:!MD5:!3DES:!CAMELLIA:!AES128
    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
&lt;/VirtualHost&gt;

3. Access control

Based on IP restrictions: Allow or deny requests from a specific IP address or range.
Certification and authorization: Implement basic or summary authentication for sensitive resources to ensure that only authorized users can access it.

<Directory "/var/www/html/admin">
    AuthType Basic
    AuthName "Restricted Area"
    AuthUserFile /etc/httpd/.htpasswd
    Require valid-user
</Directory>

4. Prevent common attacks

Cross-site scripting attack (XSS): Defense with appropriate content security policies (CSP) and output encoding.

SQL Injection: Ensure that all database queries have been properly parameterized to avoid direct splicing of user input.

File upload vulnerability: Strictly verify the type and size of uploaded files and limit the location where files can be uploaded.

5. Security head settings

HTTP Strict Transmission Security (HSTS): Force the browser to access the site only via HTTPS.
X-Frame-Options: Prevent click hijacking, specify whether the page can be displayed in the frame.
Content Security Policy (CSP): Define what is trustworthy and help prevent multiple types of attacks.

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header set X-Frame-Options DENY
Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';"

6. Log monitoring and auditing

Detailed logging: Ensure that the sufficient logging level is enabled for review in the event of a security incident.
Intrusion Detection System (IDS): Consider integrating WAF (Web Application Firewall) like ModSecurity, which can analyze traffic in real time and block malicious activity.

7. File permission management

Set file permissions correctly: Ensure that the files under the web root directory and its subdirectories have appropriate read and write permissions to avoid unnecessary permissions being opened.
Hide sensitive information: Remove or protect.htaccessSensitive configuration in the file to prevent the leak of the internal structure of the server.

in conclusion

By carefully configuring the Apache server, the risk of attacks can be greatly reduced. The above suggestions are just the starting point, and each environment has its own uniqueness, so security policies should be adjusted according to actual conditions. Continuously paying attention to the latest security trends and technologies, and constantly improving and optimizing your server configuration is the key to ensuring long-term security.

This is the article about the security configuration guide for Apache HTTP server. For more related Apache HTTP server content, please search for my previous articles or continue browsing the related articles below. I hope everyone will support me in the future!