Securing Apache2 Web Server Against Attacks

This tutorial provides a step-by-step guide to securing your Apache2 web server against common vulnerabilities and attacks. Follow these best practices to harden your server and protect it from threats.

Table of Contents

1. Introduction
2. Keep Apache2 Updated
3. Configure Firewall
4. Disable Directory Listing
5. Limit Server Information
6. Enable HTTPS
7. Enable Security Modules
8. IP Whitelisting
9. Rate Limiting
10. Content Security Policy (CSP)
11. Enable Mod_Suohee
12. Log Monitoring and Fail2ban
13. Disable Unused Modules
14. Additional Security Tips
15. Summary

Introduction

Apache2 is a widely used open-source web server, but it can be vulnerable to attacks if not properly configured. This tutorial covers essential steps to secure your Apache2 server against common threats.

Update Apache2

Regularly updating Apache2 ensures you receive security patches and bug fixes.

sudo apt update && sudo apt upgrade apache2

Configure Firewall

Restrict access to only necessary ports using ufw (Uncomplicated Firewall):

sudo ufw allow ssh
sudo ufw allow http
sudo ufw allow https
sudo ufw enable

Explanation:

• SSH (port 22): Required for server access.
• HTTP (port 80) and HTTPS (port 443): For web traffic.

Disable Directory Listing

Prevent sensitive directory contents from being exposed:
Edit Apache config:

sudo nano /etc/apache2/sites-available/000-default.conf

Add under <Directory /var/www/html>:

Options -Indexes

Apply changes:

sudo systemctl restart apache2

Limit Server Information

Reduce information Apache2 reveals about itself:
Edit Apache config:

sudo nano /etc/apache2/apache2.conf

Add the following lines:

ServerTokens Prod
ServerSignature Off

Apply changes:

sudo systemctl restart apache2

Enable HTTPS

Use Let’s Encrypt to obtain a free SSL certificate and enable HTTPS:

1. Install Certbot:

   Copy

   sudo apt install certbot python3-certbot-apache

2. Run Certbot:

   Copy

   sudo certbot --apache -d yourdomain.com

Notes:

• Redirect HTTP to HTTPS:
  Add this to your virtual host config:

  Copy

  RewriteEngine On
  RewriteCond %{HTTPS} off
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Enable Security Modules

Install and enable critical security modules:

ModSecurity (Web Application Firewall)

sudo apt install libapache2-mod-security2
sudo nano /etc/modsecurity/modsecurity.conf

Uncomment:

SecRuleEngine DetectionOnly

Apply changes:

sudo systemctl restart apache2

Mod_Litmod (Rate Limiting)

sudo apt install libapache2-mod-evasive
sudo a2enmod evasive
sudo systemctl restart apache2

IP Whitelisting

Restrict access by IP address:
Edit Apache config:

sudo nano /etc/apache2/sites-available/000-default.conf

Add:

<Limit GET POST>
    Require host 192.168.1.100  # Replace with allowed IPs
</Limit>

Apply changes:

sudo systemctl restart apache2

Rate Limiting

Prevent brute-force attacks:
Edit /etc/modsecurity/modsecurity.conf:

• Find the <Evasion> section and configure:

EvasionAction StatusCode 450
EvasionMaxSecRulePerIPLimit 3

Restart Apache2:

sudo systemctl restart apache2

Content Security Policy (CSP)

Add CSP headers to your virtual host config:

<VirtualHost *:80>
    ...
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'"
</VirtualHost>

Notes:

• Customize policies based on your site’s needs.
• CSP protects against XSS by restricting script sources.

Enable Mod_Suohee

Block directory traversal attacks:

sudo a2enmod mod_suohee
sudo systemctl restart apache2

Log Monitoring and Fail2ban

Monitor logs and block brute-force attacks:

1. Install Fail2ban:

   Copy

   sudo apt install fail2ban

2. Edit the Apache jail:

   Copy

   sudo nano /etc/fail2ban/jail.local

Add Apache security rules:

[apache-badbots]
enabled = true
port = http,https
filter = badbots
logpath = /var/log/apache2/access.log
maxretry = 100
findtime = 3600
bantime = 86400

Disable Unused Modules

Reduce attack surface by disabling unnecessary modules:

sudo a2dismod module_name

Example:

sudo a2dismod autoindex
sudo systemctl restart apache2

Additional Security Tips

1. File Permissions: Restrict access to sensitive files.
2. Backups: Regularly back up configurations.
3. HSTS: Enable HTTP Strict Transport Security (HSTS):

   Copy

   Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

4. Security Headers: Add headers like X-Content-Type-Options and X-Frame-Options.

Summary

By following these steps, you will significantly enhance the security of your Apache2 server:

• Keep Apache2 updated
• Use a firewall to restrict access
• Disable directory listing
• Limit server exposure
• Enforce HTTPS
• Enable security modules (e.g., ModSecurity, Mod_Suohee)
• Monitor logs with Fail2ban

Remember: Security is an ongoing process. Regularly review your configurations and stay informed about new threats.

Question or Need Help?
Let me know if you need clarification on any of the steps! 😊