Securing PHP:
Well, here i'm going to explain how to securde php a little better, along with apache/yourwebserver.
First of all, and the most important, do NOT run your Webserver on a administrative account.
Why?
Well, put it this way, you don't want someone hacking your webserver, then gaining complete access to your system. Create an account, setup apache/abyss or whatever you use. Then disable rights to the username you gave it.
PHP:
You'll also want to enable safe mode in the php.ini file. As with the Apache module, this restricts certain functions in PHP based on file ownership or directory location. With safe mode turned on, you're taking a proactive measure with security by defining from the start how you want PHP to behave.
open php.ini
Also, we want a full rundown of what's enabled and what's disabled on your server.
Create a .php file in your docroot with the following lines
Code:
<?php
phpinfo();
?>
In php.ini and restart your webserver to use this. You can verify whether safe mode is enabled using the above phpinfo technique. Another item to consider is the disable_functions directive. For instance, you could set this: Look for
change it to:
This depends on what scripts you use, some scripts and control panels need safe_mode to be off, such as Modernbill or ClientExc - Webhost Billing Panels.
Then in your browser, point to it, it'll show you what's enabled and all about your php version, if it's old, update to the most secure version, or downgrade if you need to.
Code:
disable_functions = "dl,phpinfo,shell_exec,passthru,exec,popen,system,
proc_get_status,proc_nice,proc_open,proc_terminate,proc_close"
Note that this list disables phpinfo as well as others. There is some overlap, here, with functions limited by safe mode. Be careful that you don't break any features you need, of course. These security settings may cause issues, so test extensively. If you don't need the functions, though, you should disable what you don't need for better security.
Open httpd.conf
Find:
Change to Then check for
Change to
Code:
ServerSignature Off
Basicly, this stops displaying server signatures (Example, when you click on a link that's none existant, it shows [IApache/1.3.37 Server at xxxxx Port 80[/I]
Remember, don't edit things you don't know what they do.
Not serving files outside of webroot,
lets say you're main folder is /homesite/
Search for
Add this, underneath
Code:
<Directory />
Order Deny,Allow
Deny from all
Options None
AllowOverride None
</Directory>
<Directory /homesite>
Order Allow,Deny
Allow from all
</Directory>
If you want to disable file listing on these directories - where you see "Options None"
Change to Options -Indexes
Turn off server side includes
This is also done with the Options directive inside a Directory tag. Set Options to either None or -Includes
Options -Includes
If you want to disable more than one option, do it like this, (example took from my unix box (what applies in linux/unix on apache, will apply to windows aswell)
Code:
Options -ExecCGI -FollowSymLinks -Indexes
If you have a resource that should only by accessed by a certain network, or IP address you can enforce this in your apache configuration. For instance if you want to restrict access to your intranet to allow only the 192.168 network (Local network)
Code:
Order Deny,Allow
Deny from all
Allow from 192.168.0.0/16
Restart Apache to take effect.
Also, i stress, as i did in the FTP guide, Maxconnections and MaxConnectionsPerIP is something you should look into, only allow 2 connections per ip max.
Settings such as
Code:
MinSpareServers, MaxSpareServers, StartServers, and KeepAliveTimeout
The lower the value is, the better it is if you have limited hardware on your system.
Credit goes to Google and UnixExperts
[Tutorial] Secure your Dedicated Windows Server!
Reply With Quote![[Tutorial] Secure your Dedicated Windows Server!](http://ragezone.com/hyper728.png)
Originally Posted by BigHanded
