How to analyze Apache log for security with Scalp

Scalp! is a log analyzer for the Apache web server that looks for security problems. It reads the Apache log and perform log analysis for possible attacks against rulesets provided by PHP-IDS project. It is available for download from it’s Google code page.

Scalp! is currently written in Python though the writer claims he’s now working on C++ version of it. Current Python can only analyze a maximum of 10000 lines of log, and seems to be a bit slow. The C++ version is aimed to overcome the problems.

When being run without any parameters, Scalp will look for access_log and default_filter.xml files in the current directory, and produce the report to the standard output. access_log is the Apache log file, and default_filter.xml is the filter rules available from the PHPIDS project. Running the program as the following will use the Apache log file at /var/log/apache2/access.log and the PHPIDS ruleset from ~/default_filter.xml;

$ python scalp.py --log /var/log/apache2/access.log --filters ~/default_filter.xml

To overcome the 10000 lines limitation of the program, a Linux program called split can be run as in the example below as a log splitter, and Scalp! is then run against all the splitted log;

$ split -l 10000  /var/log/apache2/access.log

How to redirect non-www URL to www in Apache

If both www and non www domain of your website (http://example.com and http://www.example.com) serve the same website, and you want people going to http://example.com to automatically be redirected to http://www.example.com, there's a few way that you can do so with Apache

.htaccess

First of all, make sure mod_rewrite is installed and enabled for your Apache installation. Once it is, add a file named .htaccess in your website's root directory and add the following lines;

RewriteEngine On
RewriteCond %{HTTP_HOST} ^!example.com$ [NC]
RewriteRule ^(.*)$ http://www.example.com/$1 [R=301,L]

Virtualhost

You can also change your website's Virtualhost setting for the redirect.

<VirtualHost *:80>
    ServerName example.com
    Redirect permanent / http://www.example.com/
</VirtualHost>

You'll need to restart Apache for this method to work

How to disable directory listing in Apache

If no DirectoryIndex (normally configured as index.html, index.htm, index.php, welcome.html) present in a directory, and if mod_autoindex is enabled (which by default is normally enabled), Apache would list the directory contents, as the following;

While useful for some cases, you would want to disable this feature (perhaps for security reason). There are few ways to do this.

Disable mod_autoindex

The easiest way is probably to disable the autoindex module entirely. This would affect all the sites hosted on the server, which could be both good and bad.

The module is called autoindex, and can be disabled by the a2dismod command, as in the following example.

sudo a2dismod autoindex

Directory's Options directive

The option could be applied per-directory, via the Directory's Option directive as the following.

<Directory /var/www/mysite>
    Options -Indexes
</Directory>

Notice that it's -Indexes and not +Indexes

This could be set in your Apache's configuration file.

.htaccess

The above method would also work by adding a .htaccess file with the following content that you want directory listing to be disabled.

Options -Indexes

Changes should take effect when apache is restarted.

How to change Apache user and group

Apache web server normally runs as the user nobody, www-data or apache. These users usually has limited permission on the system, and doesn't normally has shell login. This is good for security reason, but if for whatever reason you are required to run Apache as different user and group, you have the option to do that.

What you'll need to do is to change the User and Group directive in Apache configuration file. In Ubuntu the main configuration file is /etc/apache2/httpd.conf.

The following configuration will run Apache as the user nobody, and group nobody.

User nobody
Group nobody

You can change that to other user and group available in the system.

This could be a big security risk, especially to those changing the user to root

You will need to restart Apache first for the changes to take effect.

sudo /etc/init.d/apache2 restart

The check if the your changes work, run ps as the following;

ps aux | grep apache

Which should give you output imilar to the following;

root      1188  0.0  0.1 162184  6664 ?        Ss   Mar29   0:02 /usr/sbin/apache2 -k start
nobody  1197  0.0  0.1 162184  5668 ?        S    Mar29   0:00 /usr/sbin/apache2 -k start
nobody  1198  0.0  0.1 162184  5916 ?        S    Mar29   0:00 /usr/sbin/apache2 -k start
nobody  1200  0.0  0.1 162184  5684 ?        S    Mar29   0:00 /usr/sbin/apache2 -k start
nobody  1201  0.0  0.1 162184  5684 ?        S    Mar29   0:00 /usr/sbin/apache2 -k start
nobody  1202  0.0  0.1 162184  5684 ?        S    Mar29   0:00 /usr/sbin/apache2 -k start

Notice that Apache runs as the user nobody.

حماية Apache وضبط اعداداته

حماية Apache وضبط اعداداته
ما هو الاباتشى (Apache) :
الاباتشى ببساطة هو خادم الويب او سيرفس يقوم بتزويد متصفح الإنترنت الخاص بنا بصفحات الويب التى نطلبها و يستعمل الاباتشي لخدمة صفحات الويب الثابتة (لا تتغير) و الدينامكية ( تتغير مثل المنتديات ) . واهم منافس له فى وندوز Windows هو IIS (Internet Information Services)
الاباتشى موجود افتراضيا فى CPanel وسنقوم اليوم بعمل الحماية له واعداده بدون التاثير على مميزاته واستخدامه بافضل ما يكون .
بسم الله نبدأ :
هل تتتذكر اعداد الاباتشى الذى قمنا به
واخبرتك انه بشكل مؤقت !؟

سنقوم اليوم فى درسنا بحماية الاباتشى وافضل حماية باذن الله من ثغرات Symlinks والتنقل غير الشرعى بين Users

اولا :
بعد الدخول على السيرفر من خلال الشل نقوم بتنفيذ الامر التالى

رمز PHP:

nano /usr/local/apache/conf/troy.conf


سيفتح معك ملف فاضى نقوم بوضع الاعداد التالى كاملا

رمز PHP:

<Directory "/">
Options None
AllowOverride None
Order Deny,Allow
Deny from all
</Directory>

<Directory "/home">
Options Indexes SymLinksIfOwnerMatch
AllowOverride AuthConfig Indexes Limit FileInfo
RewriteEngine On
Order Deny,Allow
</Directory>
SecServerSignature "SEC.By.Ahmed.Hamdy (Ahmed.Hamdy11@msn.com)"
<Directory "/home/*/public_html/cgi-bin">
Options None
AllowOverride None
Order Deny,Allow
Deny from all
</Directory>


وهيا جزء من اعدادتى الخاصة

كما موضح بالشكل




ثم Ctrl + X للخروج ثم Y لحفظ الملف

ثم نقوم بتنفيذ الامر

رمز PHP:

/scripts/apachelimits


وبعدها ندخل على

رمز PHP:

nano /usr/local/apache/conf/httpd.conf


نضغط Ctrl + w للبحث
ونبحث عن <Directory "/"> ونحذفها بالكامل كما موضح
ثم نقوم بالبحث عن
<Directory "/usr/local/apache/htdocs">
ونعدل عليها كما موضح بالشكل
نبحث مره اخرى عن LoadModule
ونضيف بالاعلى

رمز PHP:

Include "/usr/local/apache/conf/troy.conf"


ثم نبحث عن

<Directory "/usr/local/apache/cgi-bin">

نغير Allow from all ونجعلها Deny from all

كما موضح

 

ثم نضغط Ctrl + x و y للحفظ

ونقوم بتنفيذ

رمز PHP:

service httpd restart


اذا لم تظهر لك اى اخطاء اعرف ان شغلك مضبوط
ثم بعدها نفذ

رمز PHP:

 /usr/local/cpanel/bin/apache_conf_distiller --update


ليتم حفظ ما قمنا بعمله

والان تم عمل حماية جيدة جدا للــApache

ولكن هل هذا كل شىء !!
لا فهناك الكثير من الطرق و الحلول لحماية الاباتشى بشكل كامل ولكنى لن اقوم بالتطرق اليها حاليا لانها تحتاج الى مستوى متقدم من الخبرة
وستكوون باذن الله فى المستوى الثانى من الدورة

وان شاء الله يكون الدرس واضح للجميع