Secure Your Apache Web Server

Hacking your web server is a disaster for you. Most of the times, the hacker uses the information reads from your server to attack it. (i.e. the version details, installed modules, configuration parameters etc).

So it is very essential to harden your web server and prevent publishing unnecessary information about the web server by it self.

Following given settings prevent publishing such information.

Hiding Apache Version

Impact: Exposing apache version may help to use exploits against the server.
Setting: In Apache/Httpd conf file
Methodology

• Open your httpd.conf file using text editor such as vi:
  e.g. vi httpd.conf
• Append/modify config directive as follows:
• Set ServerTokens parameter at apache config file section 1 to ProductOnly
  ServerTokens ProductOnly
  
  
• Set ServerSignature at apache config file Section 2: 'Main' server configuration to  Off

                 ServerSignature Off

• Save and close the file. Restart Apache web server:

• e.g. # /etc/init.d/httpd restar

Hiding PHP version
Settings: PHP configuration file (i.e. php.ini)

Note: The location of the php.ini is depending on the PHP version that you are using. Following are the possible locations

• /etc/php.ini
•  /etc/php4/apache/php.ini(For php4)
• /etc/php5/apache/php.ini (For php5) 

Methodology:
Change the following option

• expose_php Off

 Turn Off Directory Indexing

Setting: In Apache/Httpd conf file

Methodology:
Change the Option setting inside the <Directory/>___</Directory> tags to restrictive setting;

e.g.

<Directory />
    Options FollowSymLinks
    AllowOverride None
</Directory>
More details at httpd.apache.org/docs/2.2/mod/core.html#options

Good Reference
 http://www.petefreitag.com/item/505.cfm

Two Postfix Instances in One Server

Actually this was required to me to configure a server

• to work as a mail relay for my domain say chamara.xy (External people/mail servers should send emails to someone@chamara.xy to this server)
• to work as the submission server for my clients (someone@chamara.xy should send mail to any outside domain after authenticated by the server)

There are several mechanisms to implement this and following given are some important references;
http://www.postfix.org/MULTI_INSTANCE_README.html
http://www.howtoforge.com/forums/showthread.php?t=4788

When I reading the details I found following link (http://linuxpoison.blogspot.com/2008/02/howto-make-two-instance-of-postfix.html) which was quite easy and interesting. I configured the server referring the above document. The steps I followed is as given below;

Consider the main instance of Postfix is having its configurations in /etc/postfix

• Copy the /etc/postfix directory and all files to another directory (Say /etc/postfix_smtp)
• Change the parameters in the /etc/postfix_smtp/main.cf according to the new instance of the postfix

Here the spool folder should be different and should be created.
The document says Each instance of Postfix must have it's own mail spool directory.
To avoid file conflicts, the default directory /var/spool/postfix must not be shared among instances.

• Edit the master.cf file in /etc/postfix-smtp and enable it to run on port 25

smtp inet n - n - - smtpd

• Edit the master.cf in /etc/postfix and enable the submission port for the smtpd daemon

submission inet n - n - - smtpd

• Edit the file /etc/postfix/main.cf and add the following near the bottom of the file:

alternate_config_directories = /etc/postfix-smtp

The above setting is required to inform the Postfix daemons about the second instance

Now you have 2 instances with 2 different configuration settings (i.e. /etc/postfix and /etc/postfix_smtp). You need to create startup scripts to both. One instance can run postfix in port 587 with relevant authentication configurations while other can run on port 25 as a mail relay server for your domain)

Add IPv6 route in Windows 7

In Windows XP you can add IPv6 route easily using the GUI provided at the network configuration.
Following given a good reference on how to set a IPv6 route in XP
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/sag_ip_v6_pro_rt_add.mspx?mfr=true


But for Widows7 it is not that easy.. Or I was not able to add a IPv6 route as for XP through the GUI. So, I tried the command line interface to add another route (Other than the default route which is automatically configured with the IPv6 settings)

Assume you have a network 2001:df0:12:a00::/64 and
your IP is 2001:df0:12:a00::1 and
your default gateway is 2001:df0:12:a00::ffff. 
So your default route will be
::/0 --> 2001:df0:12:a00::ffff

Assume you want to add another router to forward 64:eeb9::/96 (Which is NAT64 default network) to 2001:df0:12:a00::20 (Which is the NAT64 server of the network).

Now run the command line interface as the administrator (or a user with admin privileges)

'netsh interface ipv6 add route 64:eeb9::/64 "Local Area Connection" 2001:df0:12:a00::20' 

If the command is accepted it will display 'OK'

To check the routing entries type the following command

'netsh interface ipv6 show route'

It will display all routing related to IPv6 interface.

Please note that you have to give the interface name properly which I have given here as "Local Area Connection". It depend on the network interface that you want to use for IPv6 communication. By issuing the command ipconfig /all you can see the names of all the interfaces in your PC.