In the server section, click on the Apache server icon. The welcome screen is divided in two parts, general configuration and virtual server configuration. virtualhost refers to the possibility of hosting many sites on the same Apache server. The global configuration applies to all virtual hosts.

The standard configuration provided often works without any modification. One of the most used features is virtualhosts. To activate them, make sure you have to following 2 lines in /etc/httpd/conf/httpd.conf :

NameVirtualHost *:80
     Include conf/vhosts.d/*.conf

You only have to declare them in a file indicating the DocumenRoot (where the files are physically) and the ServerName (to identify the virtual host). According to the default configuration provided with Mandriva Linux, you need to provide a file named *.conf placed in /etc/httpd/conf/vhosts.d.

Let's illustrate our discussion with an example :

<VirtualHost *:80>
     DocumentRoot /var/www/html/test1
     ServerName www.test1.com
     </VirtualHost>

     <VirtualHost *:80>
     DocumentRoot /var/www/html/test2
     ServerName www.test2.org
     </VirtualHost>

Restart Apache and test.

The initscript /etc/init.d/httpd has options to manage the start, stop and information queries:

Apart from the commands suggested above, you can validate the proper operation of the server with telnet on port 80 or 443 :

By default, a private key and a certificate are issued during the installation. To generate keys, you need openssl. Keys and certificates are kept, by default, in /etc/pki/tls/private/localhost.key and /etc/pki/tls/certs/localhost.crt.

configuration files are :

You need to edit a section in the file /etc/httpd/modules.d/41_mod_ssl.default-vhost.conf to enable the certificate on part of the server.

<IfDefine HAVE_SSL> <IfModule !mod_ssl.c>
     LoadModule ssl_module modules/mod_ssl.so </IfModule>
     </IfDefine>

     <IfModule mod_ssl.c>
     NameVirtualHost 192.168.40.119:443
     <VirtualHost toto:443>
     ServerName toto
     SSLEngine on
     SSLCertificateFile /etc/pki/tls/certs/localhost.crt
     SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
     DocumentRoot /var/www/html/vhost4
     ErrorLog logs/ssl_error_log
     <IfModule mod_log_config.c>
     TransferLog logs/ssl_access_log
     </IfModule>
     </VirtualHost>
     </IfModule>

Reload your server, you should now be able to access the URL https://192.168.40.119 and accept the certificate for your machine.

Securing Apache essentially implies modifying the base configuration provided during installation, mainly located in /etc/httpd/conf/httpd.conf.

First, delete the service banner, as it provides valuable information to guide attackers. In /etc/httpd/conf/httpd.conf :

ServerSignature Off
     ServerTokens Prod

To check,use command HEAD :

We also recommend deleting the name resolution: it creates unnecessary network traffic. In /etc/httpd/conf/httpd.conf:

HostnameLookups Off

Also, let's delete the possibility for users to publish web pages from their /home directories (Apache mod_userdir module). This module is no longer installed by default, but lets make sure it's not there:

# rpm -qa | grep apache-mod_userdir

Comment the following line in /etc/httpd/conf/httpd.conf :

# LoadModule userdir_module modules/mod_userdir.so

Forbid page index posting: in the directives definition <Directory>, disable Indexes as much as possible. Check for the presence of the <Directory /> directive in /etc/httpd/conf/httpd.conf. It must include at least the following elements :

<Directory />
    Options -Indexes 
    AllowOverride None
     </Directory>

If you use virtualhosts on this machine, create a “virtualhost catch-all”. This way, if a visitor launches a request on the IP address instead of the “virtualhost” name, you will be able to control the page posted.

<VirtualHost _default_:*>
     DocumentRoot /var/www/html/defaut
     </VirtualHost

Remember to create the matching directory for the specified DocumentRoot and place an index.html file within this directory.

It is also very useful to have specific log files for each virtualhost to quickly identify future problems. This will give you the following log file tree (to create):

/var/log/httpd/
	|-virtualhost1
	|	|-access_log
	|	`-error_log
	|-virtualhost2
	|	|-access_log
	|	`-error_log
	...

Below, you have an example of a vitrualhost configuration file using this log file separation:

# cat /etc/httpd/conf/vhosts.d/virtualhost1
     <VirtualHost 172.20.30.40>
     DocumentRoot /var/www/html/virtualhost1
     ServerName virtualhost1.domaine.com
	
     ErrorLog logs/virtualhost1/error_log
     CustomLog logs/virtualhost1/access_log combined
     </VirtualHost>
    

You also need to update the Apache log rotation system to take the new log files into account :

# cat /etc/logrotate.d/httpd
/var/log/httpd/*_log /var/log/httpd/virtualhost1/*_log 
	/var/log/httpd/apache_runtime_status /var/log/httpd/ssl_mutex {
    rotate 5
    monthly
    missingok
    notifempty
    nocompress
    prerotate
        /etc/rc.d/init.d/httpd closelogs > /dev/null 2><1
    endscript
    postrotate
        /etc/rc.d/init.d/httpd closelogs > /dev/null 2><1
    endscript
}
    

Only PHP5 is provided by Mandriva Enterprise Server 5. By default, PHP5 is compiled with the hardened-php patch that increases security, such as disabling unsecured code. More info is available at: the hardened PHP project site.

The main package to install is apache-mod_php which will modify the Apache configuration to take php into account and restart Apache. You will also have to satisfy some dependencies with some basic php modules required in most configurations.

To setup a “LAMP” environment, you'll also need to install the Apache module enabling SQL support for PHP: php-mysql

PHP configuration is mainly done within the /etc/php.ini file. Each feature is introduced in [bloc ] form. Each variable is described as following:

variable = value

The default file is usually enough to have a working php environment. We will look at improving php security in the next chapter.

Mandriva Enterprise Server 5 contains the following difference: /etc/php.d. To simplify your php.ini file, all dynamic modules have their own dedicated file in /etc/php.d and are included in the global configuration. By default, we have the following files: :

# ls /etc/php.d
12_ctype.ini      22_ftp.ini        37_mysqli.ini     57_sysvsem.ini
13_curl.ini       23_gd.ini         42_pgsql.ini      58_sysvshm.ini
18_dom.ini        24_gettext.ini    43_posix.ini      60_tokenizer.ini
21_openssl.ini    26_iconv.ini      47_session.ini    62_xml.ini
21_zlib.ini       28_ldap.ini       54_hash.ini       62_xmlrpc.ini
63_xmlreader.ini  64_xmlwriter.ini  70_pdo.ini        78_sqlite.ini
81_filter.ini     82_json.ini       98_suhosin.ini

We suggest a number of improvements to the default configuration. All of these should be accomplished within /etc/php.ini.

disable_functions = exec,system

$ lynx -dump http://fr.php.net/manual/fr/ref.filesystem.php | 
grep 'function\.' | awk -F'.' '{ print $5 }'

These ACLs can establish access authorization as well as the resource caching. ACL configuration is located in /etc/squid/squid.conf.

This list is not complete, but illustrates the most common ACLs.

By default, the server listens on port 3128 and no client/network is authorized to pass through the proxy.

http_port 3128
	
#Recommended minimum configuration:
acl all src 0.0.0.0/0.0.0.0
acl localhost src 127.0.0.1/255.255.255.255

http_access allow localhost

http_access deny all

Only the proxy (acl localhost src 127.0.0.1/255.255.255.255) is authorized to use the (http_access allow localhost). All other machines, no matter what their IP is, (acl all src 0.0.0.0/0.0.0.0) will have their request denied (http_access deny all).

To authorize the local network to use the proxy, it must be declared with an ACL which specifies the appropriate network :

acl MyNetworks src 10.0.0.0/24 192.168.0.0/24

We must authorize this ACL:

http_access allow MyNetworks

Which gives the following configuration :

acl all src 0.0.0.0/0.0.0.0
acl localhost src 127.0.0.1/255.255.255.255
acl MyNetworks src 10.0.0.0/24 192.168.0.0/24
...
http_access allow localhost
http_access allow MyNetworks
http_access deny all

We can consider modifying the “all” ACL instead of adding a new one, but that may cause a problem, since there is no default policy.

Here is a combination of ACLs on the IP and the schedule :

Which gives us the following global configuration :

acl all src 0.0.0.0/0.0.0.0
acl localhost src 127.0.0.1/255.255.255.255
acl MyNetworks src 10.0.0.0/24 192.168.0.0/24
acl WORKING time MTWHF 08:30-18:30
...
http_access allow localhost
http_access allow MyNetworks WORKING
http_access deny all

The cache is the memory of Squid. Like access, it is possible to use ACLs to authorize or deny caching of certain objects. In general, we will not cache dynamic pages, such as CGI, and general requests with a “?” in the URL.

acl QUERY urlpath_regex cgi-bin \?
     no_cache deny QUERY

The cache works with a system of disk swap. Most recent objects are kept in memory, while older ones a kept on disk. Hence, you need to adjust the size of the memory cache (directive cache_mem, by default 8M) and on disk (directive cache_dir, 100M by default) according to your Internet load to reduce swapping.

You also need to establish minimum and maximum size of the objects to put in your cache. (directives minimum_object_size – default 0KB, maximum_object_size - default 4096KB, maximum_object_size_in_memory – default 8KB). To have an efficient cache, make sure you have enough RAM and fast disk drives (SCSI).