How To Setup A Secure Apache Web Server On Linux

Apache is a solid and stable web server that has been around for years. Apache can also be used to host multiple websites at a single time through the use of its virtual hosts feature. There is also an option to use SSL protocol, making websites safe and secure.

1. Installing and Configuring Apache Web Server

When working with Apache, you need to packages. The first is httpd, which actually installs the Apache web server. The second is the mod_ssl package, which provides secure websites.

Step 1. Install the two required packages:

Step 2. Make sure that the service is set to start when the system boots:

Step 3. Configure web server:

During the installation, a directory (/var/www) is created with a set of subdirectories. There are also a few config files to look at:

/etc/httpd/conf/httpd.conf Main config file

/var/log/httpd                       Log file directory for web server

/usr/lib/httpd/modules Modules for Apache

Be default, the location of a website is located in the /var/www/html directory, although this can be changed by editing the DocumentRoot option as well as the Directory option. It’s very important that you should test your config files first then reload the service. I think you don’t want your client’s connections being stop by using restart command.

Step 1. for your web server to become fully functional, you need to open port 80 and 443.

Step 2. For RHEL5, you need to disable the SELinux service protection to be able to utilize basic web services:

Step 3. Apache makes use of the file contexts because of the different web content available on disk. The context of any newly created directory needs to be set for the web server user to be able to access it properly. 

Step 1. Limit the IP address on which the server can listen for incoming connections.  Suppose you have two IP addresses: 192.168.1.1 and 192.168.1.1. Let’s configure Web server listen only form the 172.168.1.1 IP address on port 80 for incoming requests (httpd.conf).

Step 2. Restrict the networks, IP addresses, or domains that have access to the web server. In the <Directory> section, let’s set up Allow from and Deny from options.

Step 3. Allow only certain users to access the web server or portions of the web server. Here are the options that can be used to used based security:

AuthType Defines the authencation type

AuthName Adds comment for the user to see on login

AuthUserFile Specifies the file used to define username and password

AuthGroupFile Is similar to the user file but for groups

Require Specifies the users or groups that can login

Let’s look at an example to make the usage of these options more clear:

You can use the htpasswd command to create the user and group accounts. Remember not to user -c option again when create another user.

Step 4. Allow only certain groups to access the portions of the web server. Here are the options that can be used to used based security:

First, open your main config file and change your <Directory> section:

This is allowed on a per-directory basis because you are allowing this file to “override” the default access of anyone. The create the following file (.htaccess):

The last step you need to do is add a few user accounts.

Now if you try to access http://172.168.1.1 and http://172.168.1.1/hr, you need to type the different username and password to get inside. 

One of the big benefits of Apache is that you can run multiple websites on a single host. This is done though a virtual host configuration, where you can define different sites in your main Apache config file. Setting up virtual hosts is easy; just do the following (httpd.conf):

Let’s deploy a CGI application on the web server. Add the following section to your /etc/httpd/conf/httpd.conf file:

Then we create a directory to hold your web application:

Now if you navigate to http://172.168.1.1/webapp/test.py, you should see the CGI application be executed in the browser! There are many other types of applications that you can run, such as PHP, RUBY, and JAVA.

There are two basic files you can use to troubleshoot with:

/var/log/httpd/access_log Logs all access to the server

/var/log/httpd/error_log Logs error messages from the server

/var/log/httpd/ssl_request_log Logs requests made to the server from clients

One common error that everyone seems to get when starting the service is about the ServerName option not being set, so the web server assumes 127.0.0.1 by default. 

Another useful tool to troubleshoot web server issues with is the elinks browser. 

Have fun!