I am trying to tighten up my apache security a bit. Looking at the
"Security Tips" page in the apache documentation doesn't help a *lot*
because it's mostly talking about a multi-user system where you are
trying to make apache secure against the local users.
My situation (like a lot of other Linux users I suspect) is that I am
the only user of the system so, apart from my stupidity, local users
are not a serious risk. The only local user knows the root password
anyway! :-)
What I'm after is making it so that the outside world (my router
allows access for http requests) can only see the web pages that I
want them to see. I also want it to be arranged so that I'm unlikely
to mess up this security inadvertently.
The one thing that the apache Security Tips suggests that does seem
relevant to my situation is to do:-
<Directory />
Order Deny,Allow
Deny from all
</Directory>
instead of the default:-
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>
Which means that if I point a symlink somewhere stupid by mistake the
outside world might access almost anything.
Have I understood the above right?
It certainly seems to me that what I should do is set things up so
that apache can get at nothing and then open up specific directories.
One other thing I want is to allow local access only to most of my web
pages which is easy enough with something like:-
<Directory /var/www/html/maxine>
AllowOverride None
Order Deny,Allow
Deny from all
Allow from 192.168.1 193.128.168.194
</Directory>
and I'll open up (say) /var/www/html/public to allow 'all' access.
Is it worth being this careful/paranoid? Is apache's security good
enough for the above to be effective?
--
Chris Green