seguran�a no servidor web apache

-> pacotes necess�rios para o mandriva 2006 powerpack+

apache-base-2.0.54-13.2.20060mdk
apache-conf-2.0.54-12mdk
apache-mpm-prefork-2.0.54-13.2.20060mdk
apache-modules-2.0.54-13.2.20060mdk

--> protegendo aplica��es web com mod_security

o modsecurity � uma ferramenta de detec��o e preven��o de intrusos para

aplica��es web (ou um firewall de aplica��es). pode ser utilizado como um m�dulo
para o apache ou como standalone, o prop�sito do modsecurity � aumentar a
seguran�a das aplica��es web, as protegendos de ataques conhecidos e at� mesmo de
desconhecidos. mas como isso? ele se baseia em padr�es de ataques.

- site: http://www.modsecurity.org

executar aplica��es web p�blicas de complexidade razo�vel em um servidor

web, traz boas possibilidades de vc ter algum tipo de problema de seguran�a. por
exemplo:

http://www.webapp.com/login.php?username=admin';drop%20table%20users--

se aplica��o estivesse vulner�vel ao ataque "sql injection", a base de

usu�rios pode ser "deletada"

o m�dulo do apache "mod_security" pode prevenir destes e outro ataques.

secfilter "drop[[:space:]]table"

isto detectaria tantao ataques em m�todos post como get

- o que mais o mod_security pode fazer:

http://www.modsecurity.org/projects/modsecurity/apache/index.html

--> instalando

- instalar pacote apache-mod_security

- ln -s /etc/httpd/2.0/conf/mod_security-snortrules.conf /etc/httpd/conf/

- observar a linha no arquivo /etc/httpd/conf/httpd.conf

# bring in additional module-specific configurations
include modules.d/*.conf

- olhar agora o arquivo: /etc/httpd/modules.d/82_mod_security.conf

este arquivo inclui o arquivo de regras: /etc/httpd/conf/mod_security-
snortrules.conf

--> configurando

- edite o arquivo /etc/httpd/modules.d/82_mod_security.conf

este arquivo possui o b�sico da configura��o do mod_security e seu

funcionamento
 - secserversignature "microsoft-iis/5.0"
mascara a vers�o do apache

- secauditengine on
ativa logs do mod_security
ver: /var/log/httpd/audit_log

- secfilterdebuglevel 2
nivel do log em modo debug
ver: /var/log/httpd/mod_sec_debug_log

--> testando

http://127.0.0.1/cgi-bin/test.cgi?/bin/ls

olhar arquivos de logs

-

--> regras para o mod_security

http://www.modsecurity.org/projects/rules/index.html
http://www.gotroot.com/tiki-index.php?page=mod_security+rules

--> adicionando regras

- v� para o diret�rio /etc/httpd/conf

- mkdir modsecurity

- cd modsecurity

- wget http://www.gotroot.com/downloads/ftp/mod_security/apache2/apache2-
gotrootrules-latest.tar.gz

- tar xzvf apache2-gotrootrules-latest.tar.gz

- editar : vi /etc/httpd/modules.d/82_mod_security.conf

- adicionar as regras que deseja, exemplo:

include /etc/httpd/conf/modsecurity/apache2/exclude.conf

#application protection rules

#include /etc/httpd/conf/modsecurity/apache2/rules.conf

#comment spam rules

include /etc/httpd/conf/modsecurity/apache2/blacklist.conf

#bad hosts, bad proxies and other bad players

include /etc/httpd/conf/modsecurity/apache2/blacklist2.conf

#bad clients, known bogus useragents and other signs of malware

include /etc/httpd/conf/modsecurity/apache2/useragents.conf

#known bad software, rootkits and other malware

include /etc/httpd/conf/modsecurity/apache2/rootkits.conf
 #signatures to prevent proxying through your server
#only rule these rules if your server is not a proxy
include /etc/httpd/conf/modsecurity/apache2/proxy.conf

#additional rules for apache 2.x only! do not add this line if you use
apache 1.x
include /etc/httpd/conf/modsecurity/apache2/apache2-rules.conf

- restart o apache

--> fontes:
http://www.onlamp.com/pub/a/apache/2003/11/26/mod_security.html
http://www.onlamp.com/pub/a/apache/2005/12/01/modsecurity.html?page=4
http://www.securityfocus.com/infocus/1739
http://www.modsecurity.org/download/rules/modsecurity-hardening.conf
http://www.modsecurity.org/documentation/modsecurity-apache-manual-1.9.2.html
http://www.gotroot.com/tiki-index.php?page=setup+of+mod_security

--> fazendo o apache falar menos ;)

- no arquivo de conf principal do apache: /etc/httpd/conf/httpd.conf

- servertokens prod
- serversignature off

--> fontes:
http://wiki.linuxquestions.org/wiki/securing_apache
http://www.securityfocus.com/infocus/1694
http://www.linux.com/article.pl?sid=04/07/09/1935231

-> rodando o apache em chroot

http://docs.linux.com/article.pl?sid=04/05/24/1450203&tid=2
http://www.linuxpi.net/modules.php?name=news&file=print&sid=114