SlideShare a Scribd company logo

Securing Apache Web Servers

Download as PPT, PDF
W
webhostingguy

The document discusses securing Apache web servers through the use of Mod Security and the Center for Internet Security (CIS) benchmark. It provides an agenda that covers establishing a secure foundation through hardening the operating system and DNS, minimizing the attack surface by disabling unnecessary modules and permissions, implementing access controls, using Mod Security for web application firewall capabilities, and logging and monitoring.

1 of 58
Downloaded 20 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
Securing Apache Web Servers with Mod Security & CIS Benchmark Ralph Durkee , CISSP, GSEC, GCIH, GSNA, GPEN Principal Security Consultant [email_address]
Sep 21, 2009 www.RD1.net About Ralph Durkee 25+ years of experience Systems and Network Security Software Development and Systems Administration Independent Consultant and Trainer since 1996 SANS GIAC Certified since 2000 GSEC, GCIH, GSNA, GPEN Lead Developer, Author and Maintainer for the Center for Internet Security: RedHat Linux, DNS BIND, Apache Community Instructor for SANS CISSP Certified CISSP Instructor Rochester OWASP President & ISSA VP
Sep 21, 2009 www.RD1.net Agenda Need A Secure Foundation Minimizing the Attack Surface Limiting HTTP Request Methods Access Control Mod_Security – Web Application Fire Wall Logging and Monitoring
Sep 21, 2009 www.RD1.net Center for Internet Security Benchmarks Center for Internet Security Non-profit Organization Develops Technical Security Standards Uses Consensus of Industry Experts www.CISecurity.org Benchmarks for: Most Unix and Windows Operating Systems Several Servers such as Apache and BIND Oracle and MS SQL Server Databases Others applications are in the works
Need A Secure Foundation Sep 21, 2009 www.RD1.net
Sep 21, 2009 www.RD1.net Start with a Security Hardened OS Unix or Linux recommended for Internet Apply appropriate CIS OS Benchmark Don’t mix other high risk, or critical services Regularly Apply OS and Apache updates Secure Foundation – OS Security
Sep 21, 2009 www.RD1.net Secure Foundation – DNS Cache Poisoning Attacks DNS Level attacks against your clients /customers Secure your Authoritative and Caching DNS Servers with CIS BIND Benchmark DNS Pharming Attacks Uses DNS Cache poisoning to harvest victims Bogus IP Addresses provided to Vulnerable DNS Cache Typically requires guessing DNS Query-ID and port Clients resolve domain name are directed to a spoofed hostile website instead of trusted website
Dan Kaminsky’s - DNS Attack Much more effective than traditional DNS cache poisoning. Uses: Requests many random nonexistent host names Send many negative responses with guessed QID Response: Go to server NAME & IP has the answer. Victim caches the IP address of “ DNS ” server Game over the “ DNS ” server was the target Only Complete Prevention requires DNSSEC Securing the Caching DNS Server helps Sep 21, 2009 www.RD1.net
Sep 21, 2009 www.RD1.net Apache User Account Don’t run Apache as root Use dedicated locked Account Account with Invalid Shell such as /dev/null Locked, with no valid password Example Server Configuration User apache Group apache # grep apache /etc/passwd /etc/shadow apache:x:48:48:Apache:/var/www:/dev/null apache:!!:14428:0:99999:7:::
Sep 21, 2009 www.RD1.net Set Minimal Permissions Ownership and Permissions Apache Configuration Files Read-write by group Web Admin Owned by Root No access for Other Apache reads these as root, before starting Document Root (and most sub-directories) Read-write by group Web Development Readable by Other Owned by root
Sep 21, 2009 www.RD1.net Set Minimal Permissions (2) More Ownership and Permissions CGI-BIN Directories Read-write by group Web Admin Readable & Executable by Other Owned by root Apache bin files (apachectl and httpd) Read & Execute by Wed Admin Read & Execute by root
Sep 21, 2009 www.RD1.net Subscribe to Security Advisories Web Admin and System Admin should subscribed to appropriate advisories Apache http://httpd.apache.org/lists.html CERT https://forms.us-cert.gov/maillists/ Sun https://subscriptions.sun.com Fedora Core https://www.redhat.com/mailman/listinfo/fedora-announce-list
Minimize the Attack Surface Sep 21, 2009 www.RD1.net
Sep 21, 2009 www.RD1.net Disable Unnecessary Modules Modules you probably DON’T need mod_dav - Distributed Authoring and Versioning (WebDAV) functionality mod_dav_fs – File System for mod_dav mod_status – Provide Web Server status info. mod_proxy – HTTP Proxy mod_autoindex - Directory listings mod_cern_meta - CERN HTTPD Meta file semantics (old not used)
Sep 21, 2009 www.RD1.net Use only Necessary Modules Modules you might need mod_log_config – Provides flexible for Logging of Requests mod_logio – Provides I/O bytes per request mod_mime – Determines MIME type / Handler by file extension mod_env – Controls environment passed to CGI mod_expires - Generation of Expires and Cache-Control HTTP headers
Sep 21, 2009 www.RD1.net Check Config Include Directories Check any config include directories Red Hat Linux uses /etc/httpd/conf.d All *.conf files are auto included Remove the rpm, not just the file Or comment out the file content Example: rpm –qf /etc/httpd/conf.d/ manual.conf httpd-manual-2.2.xx-xx.x rpm -e httpd-manual
Sep 21, 2009 www.RD1.net Remove Any Default Files Default HTML Files Manual Welcome page Directory Index icons Sample CGI files (e.g. printenv) Apache source code files Apache user files (.bashrc etc)
Sep 21, 2009 www.RD1.net Other Resources for Modules Modules list available On-line http://httpd.apache.org/docs/2.0/mod/ http://httpd.apache.org/docs/2.2/mod/ Also Review Module recommendations in CIS Benchmark Appendix Some Modules have their own website, (such as modsecurity.org) check your favorite search engine.
Sep 21, 2009 www.RD1.net Options Directive Apache 2.2 docs Description: Configures what features are available in a particular directory Syntax: Options [+|-]option [[+|-]option] ... Default : Options All Context : server config, virtual host, directory, .htaccess Override : Options Module : core
Sep 21, 2009 www.RD1.net Options Directive Example 1 - Top Level Root <Directory /> . . . Options None </Directory> Example 2 – cgi-bin Directory ScriptAlias /mailman/ /usr/lib/mailman/cgi-bin/ <Directory /usr/lib/mailman/cgi-bin/> . . . Options ExecCGI </Directory>
Sep 21, 2009 www.RD1.net Options Directive Options All – Everything except Multiviews ExecCGI – Execution of CGI scripts FollowSymLinks – Will follow symbolic links SymLinksIfOwnerMatch –only if owner matches Includes - Enables Server Side include IncludesNOEXEC – SSI without #exec AllowOverride – Allow usage of .htaccess files. Multiviews - Content negotiation (e.g. Language)
Access Controls Sep 21, 2009 www.RD1.net
Auth and Authz Modules mod_authz_host (was mod_access) - Access based on IP address or hostname. mod_authz_user , mod_authz_groupfile Mod_auth - user authentication using text files Sep 21, 2009 www.RD1.net
Sep 21, 2009 www.RD1.net Access Control Directives (1) Protecting Root (httpd.conf) <Directory /> Options None AllowOverride None deny from all </Directory> Allowing All Access <Directory &quot;/var/www/html/&quot;> Order allow,deny allow from all </Directory>
Sep 21, 2009 www.RD1.net Access Control Directives (2) Allowing Limited Access Usage of IP Address or partial IP Address <Directory &quot;/var/www/html/&quot;> Order allow,deny deny from all allow from 10.10.2. </Directory> Domain and Host names also work
Sep 21, 2009 www.RD1.net HTTP Basic Authentication Requires mod_auth enabled Send base64 encoded username and password sent with every request. Needs SSL to protect username/password No password guessing protection built-in Sample Configuration <Directory /var/www/html/members> AuthType Basic AuthName “Memebers Access&quot; AuthUserFile /path/to/passwordfile Require valid-user </Directory>
Sep 21, 2009 www.RD1.net HTTP Basic Authentication (2) Setup Apache Password file htpasswd -c /path/to/passwordfile jsmith New password: password Re-type new password: password Adding password for user jsmith Don’t place Password file in the DocRoot Apache needs Read-only access Don’t allow other read access.
Sep 21, 2009 www.RD1.net HTTP Digest Authentication Requires mod_auth and mod_digest enabled Uses Challenge – Response Response is encrypted with the password Does not protect data, still needs SSL No password guessing protection built-in Sample Configuration <Directory /var/www/html/members> AuthType Digest AuthName “Members Access&quot; AuthUserFile /path/to/passwordfile Require valid-user </Directory>
New ChrootDir Directive Description : Directory for apache to run chroot(8) after startup. Syntax : ChrootDir /path/to/directory Default : none Context : server config Module : event, prefork, worker Compatibility : Available in Apache 2.2.10 and later Example: ChrootDir /var/www/chroot Sep 21, 2009 www.RD1.net
New ChrootDir Directive (2) Apache Disclaimer: Note that running the server under chroot is not simple, and requires additional setup, particularly if you are running scripts such as CGI or PHP. Please make sure you are properly familiar with the operation of chroot before attempting to use this feature. Sep 21, 2009 www.RD1.net
New ChrootDir Directive (3) Makes chroot easier, but still work required. Some typical directories required: CHR=/var/www/chroot/ mkdir –p $CHR/var/www mv /var/www/* /var/www/chroot/var/www/ mkdir $CHR/var/run mkdir $CHR/tmp mkdir –p $CHR/ /var/lib/php/session Usually others? Your Mileage Will vary! Sep 21, 2009 www.RD1.net
Apache and SELinux an Alternative to chroot A different (easier?) approach to chroot Implements Mandatory Access Controls Use SELinux in targeted mode In /etc/selinux/config, set SELINUXTYPE=targeted To test, start with SELINUX=permissive Switch to SELINUX=enforcing Sep 21, 2009 www.RD1.net
Apache SELinux Polices httpd_selinux (8) man page defines contexts types: httpd_sys_content_t - all content access httpd_sys_script_exec_t – for scripts /etc/selinux/targeted/contexts/files/ file_contexts – labels directories with types /var/www/cgi-bin (/.*)? system_u:object_r: httpd_sys_script_exec_t: s0 /var/www(/.*)? system_u:object_r: httpd_sys_content_t :s0 Sep 21, 2009 www.RD1.net
Checking SELinux Labels Use –Z option on ls to see SELinux labels ls -Z /var/www drwxr-xr-x root root system_u:object_r: httpd_sys_script_exec_t cgi-bin drwxr-xr-x root root system_u:object_r: httpd_sys_content_t error drwxr-xr-x root root system_u:object_r: httpd_sys_content_t html drwxr-xr-x root root system_u:object_r: httpd_sys_content_t icons drwxr-xr-x webalizer root system_u:object_r: httpd_sys_content_t usage Sep 21, 2009 www.RD1.net
Limiting HTTP Request Methods Sep 21, 2009 www.RD1.net
HTTP Request Methods? RFC 2616 defines HTTP/1.1 Methods GET - Most used – retrieves content HEAD – Doesn’t return body, used to check for existence and updates POST – Typically used for FORM submissions PUT – Push a resource up to the server DELETE – Remove a resource TRACE – For Debugging CONNECT – for SSL Proxy connections Sep 21, 2009 www.RD1.net
Sep 21, 2009 www.RD1.net Limiting HTTP Request Methods Limit Methods to HEAD, GET and POST <Directory &quot;/var/www/html&quot;> Order allow,deny Allow from all <LimitExcept GET POST> deny from all </LimitExcept> Options None AllowOverride None </Directory> TRACE is not limited by this! HEAD is included with GET
Sep 21, 2009 www.RD1.net Deny HTTP Trace Mod_Rewrite Technique TRACE method part of RFC HTTP protocol Reflects the request back to the client Intended for Debug Used for XST (Cross-Site Tracing vulnerabilities) Use mod_rewrite to deny TRACE Method [F] Flag returns 403 Forbidden RewriteEngine On RewriteCond %{REQUEST_METHOD} ^TRACE RewriteRule .* - [F]
Sep 21, 2009 www.RD1.net Deny HTTP Trace New TraceEnable Directive Description : Determines the behavior on TRACE requests Syntax : TraceEnable [on|off|extended] Default : TraceEnable on Context : server config Module : core Compatibility : Available in Apache 1.3.34, 2.0.55 and later Example: TraceEnable off
Mod Security – The Web Application Firewall Sep 21, 2009 www.RD1.net
Sep 21, 2009 www.RD1.net Mod_Security Features Open Source Web Application Firewall Features: Request filtering Anti-evasion techniques - paths and parameters are normalized Understands the HTTP protocol Performs very specific and fine grain filtering. POST payload analysis
Sep 21, 2009 www.RD1.net Mod_Security Features (2) More Features: Audit logging - Full details can be logged for later analysis HTTPS – Analysis performed after decryption Inspect and Filter Any Headers Buffer Overflow Protection Attack Detection and Prevention
Sep 21, 2009 www.RD1.net Mod_security Configuration Easily Installed via package, or build from source. Configuration mod_security.conf Rename file if using include conf.d/ LoadModule security_module modules/mod_security.so <IfModule mod_security.c> # Turn the Filtering and Audit engine, On SecFilterEngine On SecAuditEngine RelevantOnly
Sep 21, 2009 www.RD1.net Mod_security Configuration (2) More Basic Feature Configuration # Make sure that URL encoding is valid SecFilterCheckURLEncoding On # Unicode encoding check SecFilterCheckUnicodeEncoding On # Only allow bytes from this range SecFilterForceByteRange 1 255 # Cookie format checks. SecFilterCheckCookieFormat On # The name of the audit log file SecAuditLog logs/audit_log # Should mod_security inspect POST payloads SecFilterScanPOST On # Default action set SecFilterDefaultAction &quot;deny,log,status:406&quot;
Sep 21, 2009 www.RD1.net Mod_security Filters (1) Basic Recommended Filters # Require HTTP_USER_AGENT and HTTP_HOST headers SecFilterSelective &quot;HTTP_USER_AGENT|HTTP_HOST&quot; &quot;^$&quot; # Only accept request encodings we how handle # we exclude GET requests because some (automated) # clients supply &quot;text/html&quot; as Content-Type SecFilterSelective REQUEST_METHOD &quot;!^GET$&quot; chain SecFilterSelective HTTP_Content-Type &quot;!(^$|^application/x-www-form-urlencoded$|^multipart/form-data)&quot;
Sep 21, 2009 www.RD1.net Mod_security Filters (2) More Basic Recommended Filters # Require Content-Length to be provided with # every POST request SecFilterSelective REQUEST_METHOD &quot;^POST$&quot; chain SecFilterSelective HTTP_Content-Length &quot;^$&quot; # Don't accept transfer encodings we don't handle SecFilterSelective HTTP_Transfer-Encoding &quot;!^$&quot;
Logging and Monitoring Sep 21, 2009 www.RD1.net
Sep 21, 2009 www.RD1.net Logging Directives LogLevel Controls Verbosity Values are emerg, alert, crit, error, warn, notice, info and debug Notice is recommended ErrorLog – File name for logging errors LogFormat – Defined format of log entries CustomLog logs/acces_log combined
Sep 21, 2009 www.RD1.net Logging Directives (2) Sample Logging Configuration LogLevel notice ErrorLog logs/error_log LogFormat &quot;%h %l %u %t \&quot;%r\&quot; %>s %b \&quot;%{Accept}i\&quot; \&quot;%{Referer}i\&quot; \&quot;%{User-Agent}i\&quot;&quot; combined CustomLog logs/access_log combined Combined format is fairly standard and handled well by log analysis software Use Swatch or LogWatch for log monitoring.
Sep 21, 2009 www.RD1.net Log Monitoring Sample LogWatch output with Web Attacks Requests with error response codes 404 Not Found //README: 2 Time(s) //chat/messagesL.php3: 1 Time(s) //graph_image.php: 1 Time(s) /PhpMyChat//chat/messagesL.php3: 1 Time(s) /horde-3.0.5//README: 2 Time(s) 406 Not Acceptable /: 2 Time(s) /robots.txt: 1 Time(s)
Log Monitoring (2) More Samples of Web Scans / Attacks Looking for open proxy & phone apps? 400 Bad Request http://www.wantsfly.com/prx.php?hash=457F6 ... 404 Not Found /apple-touch-icon.png: 1 Time(s) /iphone/ : 2 Time(s) /mobi/ : 2 Time(s) /mobile/ : 2 Time(s) /pda/ : 2 Time(s) /sql/ : 1 Time(s) Sep 21, 2009 www.RD1.net
Abuse Reports Why Report Attacks on your Servers? Makes it a more difficult for the attacker (Yeah, mostly for the script kiddies) Educates organizations on the state of their system and their need for response Helps make the Internet a better place Choose your “favorites” to report Use whois on IP address of the source IP to abuse email contact Reporting to questionable organizations may not be helpful, or helpful in the wrong way. Sep 21, 2009 www.RD1.net
Abuse Reports – How to (2) Keep it Simple Just the facts. To: abuse@example.com Subject: web vulnerability attack from IP xx.xx.xx.xx Logs are included below of a web vulnerability attack from the above address. This system may have been compromised or infected. Please take action to prevent further abuse. An e-mail reply is appreciated. Thank you for taking action on this. -- Ralph Durkee, CISSP, GSEC, GCIH, GSNA, GPEN Information Security Consultant USA 585-624-9551 Logs are NTP time synced in USA EDT TZ Sep 21, 2009 www.RD1.net
Abuse Reports (2) Send Sample of Access Web Logs xx.xx.xx.xx - - [03/Sep/2009:06:26:31 -0400] &quot;GET /scripts/setup.php HTTP/1.1&quot; 404 215 &quot;-&quot; &quot;Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)&quot; xx.xx.xx.xx - - [03/Sep/2009:06:26:31 -0400] &quot;GET /scripts/setup.php HTTP/1.1&quot; 404 215 &quot;-&quot; &quot;Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)&quot; xx.xx.xx.xx - - [03/Sep/2009:06:26:31 -0400] &quot;GET /phpMyAdmin/ HTTP/1.1&quot; 404 209 &quot;-&quot; &quot;Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)&quot; xx.xx.xx.xx - - [03/Sep/2009:06:26:31 -0400] &quot;GET /sql/ HTTP/1.1&quot; 404 202 &quot;-&quot; &quot;Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)” Sep 21, 2009 www.RD1.net
Abuse Reports (3) Some Recent Interesting User Agent in Logs xx.xx.xx.xx - - [03/Sep/2009:20:04:50 -0400] &quot;GET / HTTP/1.0&quot; 200 67 &quot;-&quot; &quot; Mozilla/5.0 (iPhone; U; CPU like Mac OS X; en) AppleWebKit/420+ (KHTML, like Gecko) Version/3.0 Mobile/1A543a Safari/419.3 “ xx.xx.xx.xx - - [03/Sep/2009:20:05:01 -0400] &quot;GET /apple-touch-icon.png HTTP/1.0&quot; 404 218 &quot;-&quot; &quot; Mozilla/5.0 (iPhone; U; CPU like Mac OS X; en) AppleWebKit/420+ (KHTML, like Gecko) Version/3.0 Mobile/1A543a Safari/419.3 &quot; Sep 21, 2009 www.RD1.net
Abuse Responses From: Amazon EC2 Abuse [email_address] Thank you for submitting your abuse report. We have received your report of Intrusion Attempts originating from our network. We have completed an initial investigation of the issue and learned that the activity you noticed did indeed originate from an Amazon EC2 instance. These intrusion attempts that you report were not, however, initiated by Amazon. One of the biggest advantages of Amazon EC2 is that developers are given complete control of their instances. . . . That said, we do take reports of unauthorized network activity from our environment very seriously. It is specifically forbidden in our terms of use. This instance has since been terminated. Sep 21, 2009 www.RD1.net
OSSEC.net OSSEC – Open Source HIDS, central logging and monitoring solution – aka SIM/SEM/SIEM Supports most platforms Linux/Unix/Windows/Mac Real-time alerting Active response - blocking of attacks Agent and Agentless monitoring File Integrity Monitoring Rootkit detection Sep 21, 2009 www.RD1.net
Durkee Consulting, Inc. www.rd1.net [email_address] Questions?

More Related Content

PPT
WE18_Performance_Up.ppt
webhostingguy
 
PDF
[MathWorks] Versioning Infrastructure
Perforce
 
PPT
are available here
webhostingguy
 
KEY
Apache Wizardry - Ohio Linux 2011
Rich Bowen
 
PDF
Adobe AEM Maintenance - Customer Care Office Hours
Andrew Khoury
 
PPT
Red Hat Certified engineer course
Ali Abdo
 
KEY
Apache Cookbook - TekX Chicago 2010
Rich Bowen
 
PDF
Windows Server 2016 Webinar
Men and Mice
 
WE18_Performance_Up.ppt
webhostingguy
 
[MathWorks] Versioning Infrastructure
Perforce
 
are available here
webhostingguy
 
Apache Wizardry - Ohio Linux 2011
Rich Bowen
 
Adobe AEM Maintenance - Customer Care Office Hours
Andrew Khoury
 
Red Hat Certified engineer course
Ali Abdo
 
Apache Cookbook - TekX Chicago 2010
Rich Bowen
 
Windows Server 2016 Webinar
Men and Mice
 

What's hot (20)

PPTX
CONFidence 2018: Attacking web servers via run time configuration (Eldar "Wir...
PROIDEA
 
PDF
Keeping DNS server up-and-running with “runit
Men and Mice
 
PDF
Squid proxy-configuration-guide
jasembo
 
PDF
Oracle Database on Docker
Franck Pachot
 
PDF
Software Packaging with RPM
Schalk Cronjé
 
PDF
Word Press Security
Randall Rode
 
PPT
Apache Web Server Setup 4
Information Technology
 
PDF
Configure, Pack and Distribute: An RPM Creation Workshop
Novell
 
PPT
Apache Web Server Setup 1
Information Technology
 
PDF
RIPE 71 and IETF 94 reports webinar
Men and Mice
 
PDF
What is new in BIND 9.11?
Men and Mice
 
PDF
Kea DHCP – the new open source DHCP server from ISC
Men and Mice
 
PDF
DNSTap Webinar
Men and Mice
 
PPTX
Squid
Syeda Javeria
 
PPT
Apache web server installation/configuration, Virtual Hosting
webhostingguy
 
PDF
BIND 9 logging best practices
Men and Mice
 
PDF
Bundling Packages and Deploying Applications with RPM
Alexander Shopov
 
ODP
Firebird Performance counters in details
Mind The Firebird
 
PDF
Apache Web server Complete Guide
webhostingguy
 
PPT
Apache Web Server Setup 3
Information Technology
 
CONFidence 2018: Attacking web servers via run time configuration (Eldar "Wir...
PROIDEA
 
Keeping DNS server up-and-running with “runit
Men and Mice
 
Squid proxy-configuration-guide
jasembo
 
Oracle Database on Docker
Franck Pachot
 
Software Packaging with RPM
Schalk Cronjé
 
Word Press Security
Randall Rode
 
Apache Web Server Setup 4
Information Technology
 
Configure, Pack and Distribute: An RPM Creation Workshop
Novell
 
Apache Web Server Setup 1
Information Technology
 
RIPE 71 and IETF 94 reports webinar
Men and Mice
 
What is new in BIND 9.11?
Men and Mice
 
Kea DHCP – the new open source DHCP server from ISC
Men and Mice
 
DNSTap Webinar
Men and Mice
 
Squid
Syeda Javeria
 
Apache web server installation/configuration, Virtual Hosting
webhostingguy
 
BIND 9 logging best practices
Men and Mice
 
Bundling Packages and Deploying Applications with RPM
Alexander Shopov
 
Firebird Performance counters in details
Mind The Firebird
 
Apache Web server Complete Guide
webhostingguy
 
Apache Web Server Setup 3
Information Technology
 
Ad

Viewers also liked (7)

PDF
Web Servers
webhostingguy
 
PPT
Semantic Web Servers
webhostingguy
 
PDF
DUE DATE 3/1/06
webhostingguy
 
PPT
Understanding
webhostingguy
 
PPT
Attachment D
webhostingguy
 
PDF
Securing Public Web Servers
webhostingguy
 
PDF
Crawler-Friendly Web Servers
webhostingguy
 
Web Servers
webhostingguy
 
Semantic Web Servers
webhostingguy
 
DUE DATE 3/1/06
webhostingguy
 
Understanding
webhostingguy
 
Attachment D
webhostingguy
 
Securing Public Web Servers
webhostingguy
 
Crawler-Friendly Web Servers
webhostingguy
 
Ad

Similar to Securing Apache Web Servers (20)

PPT
Durkee apache 2009_v7
Denys Zabiyako
 
PPT
Ch 22: Web Hosting and Internet Servers
webhostingguy
 
PPTX
AEM (CQ) Dispatcher Security and CDN+Browser Caching
Andrew Khoury
 
ODP
Android porting for dummies @droidconin 2011
pundiramit
 
PPT
Apache ppt
Sanmuga Nathan
 
PDF
Intro to development sites and site migration
R-Cubed Design Forge
 
PPT
Install and configure linux
Vicent Selfa
 
PDF
Apache2 BootCamp : Getting Started With Apache
Wildan Maulana
 
PPT
apresentacao_apache2..
webhostingguy
 
PPT
apresentacao_apache2..
webhostingguy
 
PPT
Dot netnuke
you steve
 
PPT
Apache
Rathan Raj
 
PPT
Apache
NIRMAL FELIX
 
PDF
Apache Server Tutorial
Jagat Kothari
 
PDF
How do I securely deploy Internet websites in PHP on my IBMi?
Zend by Rogue Wave Software
 
PPT
Apache Ppt
Hema Prasanth
 
PDF
PowerPoint Presentation
webhostingguy
 
PDF
DevOPS training - Day 1/2
Vincent Mercier
 
PPT
Apache Web Server Setup 2
Information Technology
 
PPTX
Deploying Windows Containers on Windows Server 2016
Ben Hall
 
Durkee apache 2009_v7
Denys Zabiyako
 
Ch 22: Web Hosting and Internet Servers
webhostingguy
 
AEM (CQ) Dispatcher Security and CDN+Browser Caching
Andrew Khoury
 
Android porting for dummies @droidconin 2011
pundiramit
 
Apache ppt
Sanmuga Nathan
 
Intro to development sites and site migration
R-Cubed Design Forge
 
Install and configure linux
Vicent Selfa
 
Apache2 BootCamp : Getting Started With Apache
Wildan Maulana
 
apresentacao_apache2..
webhostingguy
 
apresentacao_apache2..
webhostingguy
 
Dot netnuke
you steve
 
Apache
Rathan Raj
 
Apache
NIRMAL FELIX
 
Apache Server Tutorial
Jagat Kothari
 
How do I securely deploy Internet websites in PHP on my IBMi?
Zend by Rogue Wave Software
 
Apache Ppt
Hema Prasanth
 
PowerPoint Presentation
webhostingguy
 
DevOPS training - Day 1/2
Vincent Mercier
 
Apache Web Server Setup 2
Information Technology
 
Deploying Windows Containers on Windows Server 2016
Ben Hall
 

More from webhostingguy (20)

PPT
File Upload
webhostingguy
 
PDF
Running and Developing Tests with the Apache::Test Framework
webhostingguy
 
PDF
MySQL and memcached Guide
webhostingguy
 
PPT
Novell® iChain® 2.3
webhostingguy
 
PDF
Load-balancing web servers Load-balancing web servers
webhostingguy
 
PDF
SQL Server 2008 Consolidation
webhostingguy
 
PDF
What is mod_perl?
webhostingguy
 
PDF
What is mod_perl?
webhostingguy
 
PDF
Master Service Agreement
webhostingguy
 
PPT
Notes8
webhostingguy
 
PPT
PHP and MySQL PHP Written as a set of CGI binaries in C in ...
webhostingguy
 
PDF
Dell Reference Architecture Guide Deploying Microsoft® SQL ...
webhostingguy
 
PPT
Managing Diverse IT Infrastructure
webhostingguy
 
PPT
Web design for business.ppt
webhostingguy
 
PPS
IT Power Management Strategy
webhostingguy
 
PPS
Excel and SQL Quick Tricks for Merchandisers
webhostingguy
 
PPT
OLUG_xen.ppt
webhostingguy
 
PPT
Parallels Hosting Products
webhostingguy
 
PPT
Microsoft PowerPoint presentation 2.175 Mb
webhostingguy
 
PDF
Reseller's Guide
webhostingguy
 
File Upload
webhostingguy
 
Running and Developing Tests with the Apache::Test Framework
webhostingguy
 
MySQL and memcached Guide
webhostingguy
 
Novell® iChain® 2.3
webhostingguy
 
Load-balancing web servers Load-balancing web servers
webhostingguy
 
SQL Server 2008 Consolidation
webhostingguy
 
What is mod_perl?
webhostingguy
 
What is mod_perl?
webhostingguy
 
Master Service Agreement
webhostingguy
 
Notes8
webhostingguy
 
PHP and MySQL PHP Written as a set of CGI binaries in C in ...
webhostingguy
 
Dell Reference Architecture Guide Deploying Microsoft® SQL ...
webhostingguy
 
Managing Diverse IT Infrastructure
webhostingguy
 
Web design for business.ppt
webhostingguy
 
IT Power Management Strategy
webhostingguy
 
Excel and SQL Quick Tricks for Merchandisers
webhostingguy
 
OLUG_xen.ppt
webhostingguy
 
Parallels Hosting Products
webhostingguy
 
Microsoft PowerPoint presentation 2.175 Mb
webhostingguy
 
Reseller's Guide
webhostingguy
 

Securing Apache Web Servers

  • 1. Securing Apache Web Servers with Mod Security & CIS Benchmark Ralph Durkee , CISSP, GSEC, GCIH, GSNA, GPEN Principal Security Consultant [email_address]
  • 2. Sep 21, 2009 www.RD1.net About Ralph Durkee 25+ years of experience Systems and Network Security Software Development and Systems Administration Independent Consultant and Trainer since 1996 SANS GIAC Certified since 2000 GSEC, GCIH, GSNA, GPEN Lead Developer, Author and Maintainer for the Center for Internet Security: RedHat Linux, DNS BIND, Apache Community Instructor for SANS CISSP Certified CISSP Instructor Rochester OWASP President & ISSA VP
  • 3. Sep 21, 2009 www.RD1.net Agenda Need A Secure Foundation Minimizing the Attack Surface Limiting HTTP Request Methods Access Control Mod_Security – Web Application Fire Wall Logging and Monitoring
  • 4. Sep 21, 2009 www.RD1.net Center for Internet Security Benchmarks Center for Internet Security Non-profit Organization Develops Technical Security Standards Uses Consensus of Industry Experts www.CISecurity.org Benchmarks for: Most Unix and Windows Operating Systems Several Servers such as Apache and BIND Oracle and MS SQL Server Databases Others applications are in the works
  • 5. Need A Secure Foundation Sep 21, 2009 www.RD1.net
  • 6. Sep 21, 2009 www.RD1.net Start with a Security Hardened OS Unix or Linux recommended for Internet Apply appropriate CIS OS Benchmark Don’t mix other high risk, or critical services Regularly Apply OS and Apache updates Secure Foundation – OS Security
  • 7. Sep 21, 2009 www.RD1.net Secure Foundation – DNS Cache Poisoning Attacks DNS Level attacks against your clients /customers Secure your Authoritative and Caching DNS Servers with CIS BIND Benchmark DNS Pharming Attacks Uses DNS Cache poisoning to harvest victims Bogus IP Addresses provided to Vulnerable DNS Cache Typically requires guessing DNS Query-ID and port Clients resolve domain name are directed to a spoofed hostile website instead of trusted website
  • 8. Dan Kaminsky’s - DNS Attack Much more effective than traditional DNS cache poisoning. Uses: Requests many random nonexistent host names Send many negative responses with guessed QID Response: Go to server NAME & IP has the answer. Victim caches the IP address of “ DNS ” server Game over the “ DNS ” server was the target Only Complete Prevention requires DNSSEC Securing the Caching DNS Server helps Sep 21, 2009 www.RD1.net
  • 9. Sep 21, 2009 www.RD1.net Apache User Account Don’t run Apache as root Use dedicated locked Account Account with Invalid Shell such as /dev/null Locked, with no valid password Example Server Configuration User apache Group apache # grep apache /etc/passwd /etc/shadow apache:x:48:48:Apache:/var/www:/dev/null apache:!!:14428:0:99999:7:::
  • 10. Sep 21, 2009 www.RD1.net Set Minimal Permissions Ownership and Permissions Apache Configuration Files Read-write by group Web Admin Owned by Root No access for Other Apache reads these as root, before starting Document Root (and most sub-directories) Read-write by group Web Development Readable by Other Owned by root
  • 11. Sep 21, 2009 www.RD1.net Set Minimal Permissions (2) More Ownership and Permissions CGI-BIN Directories Read-write by group Web Admin Readable & Executable by Other Owned by root Apache bin files (apachectl and httpd) Read & Execute by Wed Admin Read & Execute by root
  • 12. Sep 21, 2009 www.RD1.net Subscribe to Security Advisories Web Admin and System Admin should subscribed to appropriate advisories Apache http://httpd.apache.org/lists.html CERT https://forms.us-cert.gov/maillists/ Sun https://subscriptions.sun.com Fedora Core https://www.redhat.com/mailman/listinfo/fedora-announce-list
  • 13. Minimize the Attack Surface Sep 21, 2009 www.RD1.net
  • 14. Sep 21, 2009 www.RD1.net Disable Unnecessary Modules Modules you probably DON’T need mod_dav - Distributed Authoring and Versioning (WebDAV) functionality mod_dav_fs – File System for mod_dav mod_status – Provide Web Server status info. mod_proxy – HTTP Proxy mod_autoindex - Directory listings mod_cern_meta - CERN HTTPD Meta file semantics (old not used)
  • 15. Sep 21, 2009 www.RD1.net Use only Necessary Modules Modules you might need mod_log_config – Provides flexible for Logging of Requests mod_logio – Provides I/O bytes per request mod_mime – Determines MIME type / Handler by file extension mod_env – Controls environment passed to CGI mod_expires - Generation of Expires and Cache-Control HTTP headers
  • 16. Sep 21, 2009 www.RD1.net Check Config Include Directories Check any config include directories Red Hat Linux uses /etc/httpd/conf.d All *.conf files are auto included Remove the rpm, not just the file Or comment out the file content Example: rpm –qf /etc/httpd/conf.d/ manual.conf httpd-manual-2.2.xx-xx.x rpm -e httpd-manual
  • 17. Sep 21, 2009 www.RD1.net Remove Any Default Files Default HTML Files Manual Welcome page Directory Index icons Sample CGI files (e.g. printenv) Apache source code files Apache user files (.bashrc etc)
  • 18. Sep 21, 2009 www.RD1.net Other Resources for Modules Modules list available On-line http://httpd.apache.org/docs/2.0/mod/ http://httpd.apache.org/docs/2.2/mod/ Also Review Module recommendations in CIS Benchmark Appendix Some Modules have their own website, (such as modsecurity.org) check your favorite search engine.
  • 19. Sep 21, 2009 www.RD1.net Options Directive Apache 2.2 docs Description: Configures what features are available in a particular directory Syntax: Options [+|-]option [[+|-]option] ... Default : Options All Context : server config, virtual host, directory, .htaccess Override : Options Module : core
  • 20. Sep 21, 2009 www.RD1.net Options Directive Example 1 - Top Level Root <Directory /> . . . Options None </Directory> Example 2 – cgi-bin Directory ScriptAlias /mailman/ /usr/lib/mailman/cgi-bin/ <Directory /usr/lib/mailman/cgi-bin/> . . . Options ExecCGI </Directory>
  • 21. Sep 21, 2009 www.RD1.net Options Directive Options All – Everything except Multiviews ExecCGI – Execution of CGI scripts FollowSymLinks – Will follow symbolic links SymLinksIfOwnerMatch –only if owner matches Includes - Enables Server Side include IncludesNOEXEC – SSI without #exec AllowOverride – Allow usage of .htaccess files. Multiviews - Content negotiation (e.g. Language)
  • 22. Access Controls Sep 21, 2009 www.RD1.net
  • 23. Auth and Authz Modules mod_authz_host (was mod_access) - Access based on IP address or hostname. mod_authz_user , mod_authz_groupfile Mod_auth - user authentication using text files Sep 21, 2009 www.RD1.net
  • 24. Sep 21, 2009 www.RD1.net Access Control Directives (1) Protecting Root (httpd.conf) <Directory /> Options None AllowOverride None deny from all </Directory> Allowing All Access <Directory &quot;/var/www/html/&quot;> Order allow,deny allow from all </Directory>
  • 25. Sep 21, 2009 www.RD1.net Access Control Directives (2) Allowing Limited Access Usage of IP Address or partial IP Address <Directory &quot;/var/www/html/&quot;> Order allow,deny deny from all allow from 10.10.2. </Directory> Domain and Host names also work
  • 26. Sep 21, 2009 www.RD1.net HTTP Basic Authentication Requires mod_auth enabled Send base64 encoded username and password sent with every request. Needs SSL to protect username/password No password guessing protection built-in Sample Configuration <Directory /var/www/html/members> AuthType Basic AuthName “Memebers Access&quot; AuthUserFile /path/to/passwordfile Require valid-user </Directory>
  • 27. Sep 21, 2009 www.RD1.net HTTP Basic Authentication (2) Setup Apache Password file htpasswd -c /path/to/passwordfile jsmith New password: password Re-type new password: password Adding password for user jsmith Don’t place Password file in the DocRoot Apache needs Read-only access Don’t allow other read access.
  • 28. Sep 21, 2009 www.RD1.net HTTP Digest Authentication Requires mod_auth and mod_digest enabled Uses Challenge – Response Response is encrypted with the password Does not protect data, still needs SSL No password guessing protection built-in Sample Configuration <Directory /var/www/html/members> AuthType Digest AuthName “Members Access&quot; AuthUserFile /path/to/passwordfile Require valid-user </Directory>
  • 29. New ChrootDir Directive Description : Directory for apache to run chroot(8) after startup. Syntax : ChrootDir /path/to/directory Default : none Context : server config Module : event, prefork, worker Compatibility : Available in Apache 2.2.10 and later Example: ChrootDir /var/www/chroot Sep 21, 2009 www.RD1.net
  • 30. New ChrootDir Directive (2) Apache Disclaimer: Note that running the server under chroot is not simple, and requires additional setup, particularly if you are running scripts such as CGI or PHP. Please make sure you are properly familiar with the operation of chroot before attempting to use this feature. Sep 21, 2009 www.RD1.net
  • 31. New ChrootDir Directive (3) Makes chroot easier, but still work required. Some typical directories required: CHR=/var/www/chroot/ mkdir –p $CHR/var/www mv /var/www/* /var/www/chroot/var/www/ mkdir $CHR/var/run mkdir $CHR/tmp mkdir –p $CHR/ /var/lib/php/session Usually others? Your Mileage Will vary! Sep 21, 2009 www.RD1.net
  • 32. Apache and SELinux an Alternative to chroot A different (easier?) approach to chroot Implements Mandatory Access Controls Use SELinux in targeted mode In /etc/selinux/config, set SELINUXTYPE=targeted To test, start with SELINUX=permissive Switch to SELINUX=enforcing Sep 21, 2009 www.RD1.net
  • 33. Apache SELinux Polices httpd_selinux (8) man page defines contexts types: httpd_sys_content_t - all content access httpd_sys_script_exec_t – for scripts /etc/selinux/targeted/contexts/files/ file_contexts – labels directories with types /var/www/cgi-bin (/.*)? system_u:object_r: httpd_sys_script_exec_t: s0 /var/www(/.*)? system_u:object_r: httpd_sys_content_t :s0 Sep 21, 2009 www.RD1.net
  • 34. Checking SELinux Labels Use –Z option on ls to see SELinux labels ls -Z /var/www drwxr-xr-x root root system_u:object_r: httpd_sys_script_exec_t cgi-bin drwxr-xr-x root root system_u:object_r: httpd_sys_content_t error drwxr-xr-x root root system_u:object_r: httpd_sys_content_t html drwxr-xr-x root root system_u:object_r: httpd_sys_content_t icons drwxr-xr-x webalizer root system_u:object_r: httpd_sys_content_t usage Sep 21, 2009 www.RD1.net
  • 35. Limiting HTTP Request Methods Sep 21, 2009 www.RD1.net
  • 36. HTTP Request Methods? RFC 2616 defines HTTP/1.1 Methods GET - Most used – retrieves content HEAD – Doesn’t return body, used to check for existence and updates POST – Typically used for FORM submissions PUT – Push a resource up to the server DELETE – Remove a resource TRACE – For Debugging CONNECT – for SSL Proxy connections Sep 21, 2009 www.RD1.net
  • 37. Sep 21, 2009 www.RD1.net Limiting HTTP Request Methods Limit Methods to HEAD, GET and POST <Directory &quot;/var/www/html&quot;> Order allow,deny Allow from all <LimitExcept GET POST> deny from all </LimitExcept> Options None AllowOverride None </Directory> TRACE is not limited by this! HEAD is included with GET
  • 38. Sep 21, 2009 www.RD1.net Deny HTTP Trace Mod_Rewrite Technique TRACE method part of RFC HTTP protocol Reflects the request back to the client Intended for Debug Used for XST (Cross-Site Tracing vulnerabilities) Use mod_rewrite to deny TRACE Method [F] Flag returns 403 Forbidden RewriteEngine On RewriteCond %{REQUEST_METHOD} ^TRACE RewriteRule .* - [F]
  • 39. Sep 21, 2009 www.RD1.net Deny HTTP Trace New TraceEnable Directive Description : Determines the behavior on TRACE requests Syntax : TraceEnable [on|off|extended] Default : TraceEnable on Context : server config Module : core Compatibility : Available in Apache 1.3.34, 2.0.55 and later Example: TraceEnable off
  • 40. Mod Security – The Web Application Firewall Sep 21, 2009 www.RD1.net
  • 41. Sep 21, 2009 www.RD1.net Mod_Security Features Open Source Web Application Firewall Features: Request filtering Anti-evasion techniques - paths and parameters are normalized Understands the HTTP protocol Performs very specific and fine grain filtering. POST payload analysis
  • 42. Sep 21, 2009 www.RD1.net Mod_Security Features (2) More Features: Audit logging - Full details can be logged for later analysis HTTPS – Analysis performed after decryption Inspect and Filter Any Headers Buffer Overflow Protection Attack Detection and Prevention
  • 43. Sep 21, 2009 www.RD1.net Mod_security Configuration Easily Installed via package, or build from source. Configuration mod_security.conf Rename file if using include conf.d/ LoadModule security_module modules/mod_security.so <IfModule mod_security.c> # Turn the Filtering and Audit engine, On SecFilterEngine On SecAuditEngine RelevantOnly
  • 44. Sep 21, 2009 www.RD1.net Mod_security Configuration (2) More Basic Feature Configuration # Make sure that URL encoding is valid SecFilterCheckURLEncoding On # Unicode encoding check SecFilterCheckUnicodeEncoding On # Only allow bytes from this range SecFilterForceByteRange 1 255 # Cookie format checks. SecFilterCheckCookieFormat On # The name of the audit log file SecAuditLog logs/audit_log # Should mod_security inspect POST payloads SecFilterScanPOST On # Default action set SecFilterDefaultAction &quot;deny,log,status:406&quot;
  • 45. Sep 21, 2009 www.RD1.net Mod_security Filters (1) Basic Recommended Filters # Require HTTP_USER_AGENT and HTTP_HOST headers SecFilterSelective &quot;HTTP_USER_AGENT|HTTP_HOST&quot; &quot;^$&quot; # Only accept request encodings we how handle # we exclude GET requests because some (automated) # clients supply &quot;text/html&quot; as Content-Type SecFilterSelective REQUEST_METHOD &quot;!^GET$&quot; chain SecFilterSelective HTTP_Content-Type &quot;!(^$|^application/x-www-form-urlencoded$|^multipart/form-data)&quot;
  • 46. Sep 21, 2009 www.RD1.net Mod_security Filters (2) More Basic Recommended Filters # Require Content-Length to be provided with # every POST request SecFilterSelective REQUEST_METHOD &quot;^POST$&quot; chain SecFilterSelective HTTP_Content-Length &quot;^$&quot; # Don't accept transfer encodings we don't handle SecFilterSelective HTTP_Transfer-Encoding &quot;!^$&quot;
  • 47. Logging and Monitoring Sep 21, 2009 www.RD1.net
  • 48. Sep 21, 2009 www.RD1.net Logging Directives LogLevel Controls Verbosity Values are emerg, alert, crit, error, warn, notice, info and debug Notice is recommended ErrorLog – File name for logging errors LogFormat – Defined format of log entries CustomLog logs/acces_log combined
  • 49. Sep 21, 2009 www.RD1.net Logging Directives (2) Sample Logging Configuration LogLevel notice ErrorLog logs/error_log LogFormat &quot;%h %l %u %t \&quot;%r\&quot; %>s %b \&quot;%{Accept}i\&quot; \&quot;%{Referer}i\&quot; \&quot;%{User-Agent}i\&quot;&quot; combined CustomLog logs/access_log combined Combined format is fairly standard and handled well by log analysis software Use Swatch or LogWatch for log monitoring.
  • 50. Sep 21, 2009 www.RD1.net Log Monitoring Sample LogWatch output with Web Attacks Requests with error response codes 404 Not Found //README: 2 Time(s) //chat/messagesL.php3: 1 Time(s) //graph_image.php: 1 Time(s) /PhpMyChat//chat/messagesL.php3: 1 Time(s) /horde-3.0.5//README: 2 Time(s) 406 Not Acceptable /: 2 Time(s) /robots.txt: 1 Time(s)
  • 51. Log Monitoring (2) More Samples of Web Scans / Attacks Looking for open proxy & phone apps? 400 Bad Request http://www.wantsfly.com/prx.php?hash=457F6 ... 404 Not Found /apple-touch-icon.png: 1 Time(s) /iphone/ : 2 Time(s) /mobi/ : 2 Time(s) /mobile/ : 2 Time(s) /pda/ : 2 Time(s) /sql/ : 1 Time(s) Sep 21, 2009 www.RD1.net
  • 52. Abuse Reports Why Report Attacks on your Servers? Makes it a more difficult for the attacker (Yeah, mostly for the script kiddies) Educates organizations on the state of their system and their need for response Helps make the Internet a better place Choose your “favorites” to report Use whois on IP address of the source IP to abuse email contact Reporting to questionable organizations may not be helpful, or helpful in the wrong way. Sep 21, 2009 www.RD1.net
  • 53. Abuse Reports – How to (2) Keep it Simple Just the facts. To: abuse@example.com Subject: web vulnerability attack from IP xx.xx.xx.xx Logs are included below of a web vulnerability attack from the above address. This system may have been compromised or infected. Please take action to prevent further abuse. An e-mail reply is appreciated. Thank you for taking action on this. -- Ralph Durkee, CISSP, GSEC, GCIH, GSNA, GPEN Information Security Consultant USA 585-624-9551 Logs are NTP time synced in USA EDT TZ Sep 21, 2009 www.RD1.net
  • 54. Abuse Reports (2) Send Sample of Access Web Logs xx.xx.xx.xx - - [03/Sep/2009:06:26:31 -0400] &quot;GET /scripts/setup.php HTTP/1.1&quot; 404 215 &quot;-&quot; &quot;Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)&quot; xx.xx.xx.xx - - [03/Sep/2009:06:26:31 -0400] &quot;GET /scripts/setup.php HTTP/1.1&quot; 404 215 &quot;-&quot; &quot;Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)&quot; xx.xx.xx.xx - - [03/Sep/2009:06:26:31 -0400] &quot;GET /phpMyAdmin/ HTTP/1.1&quot; 404 209 &quot;-&quot; &quot;Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)&quot; xx.xx.xx.xx - - [03/Sep/2009:06:26:31 -0400] &quot;GET /sql/ HTTP/1.1&quot; 404 202 &quot;-&quot; &quot;Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)” Sep 21, 2009 www.RD1.net
  • 55. Abuse Reports (3) Some Recent Interesting User Agent in Logs xx.xx.xx.xx - - [03/Sep/2009:20:04:50 -0400] &quot;GET / HTTP/1.0&quot; 200 67 &quot;-&quot; &quot; Mozilla/5.0 (iPhone; U; CPU like Mac OS X; en) AppleWebKit/420+ (KHTML, like Gecko) Version/3.0 Mobile/1A543a Safari/419.3 “ xx.xx.xx.xx - - [03/Sep/2009:20:05:01 -0400] &quot;GET /apple-touch-icon.png HTTP/1.0&quot; 404 218 &quot;-&quot; &quot; Mozilla/5.0 (iPhone; U; CPU like Mac OS X; en) AppleWebKit/420+ (KHTML, like Gecko) Version/3.0 Mobile/1A543a Safari/419.3 &quot; Sep 21, 2009 www.RD1.net
  • 56. Abuse Responses From: Amazon EC2 Abuse [email_address] Thank you for submitting your abuse report. We have received your report of Intrusion Attempts originating from our network. We have completed an initial investigation of the issue and learned that the activity you noticed did indeed originate from an Amazon EC2 instance. These intrusion attempts that you report were not, however, initiated by Amazon. One of the biggest advantages of Amazon EC2 is that developers are given complete control of their instances. . . . That said, we do take reports of unauthorized network activity from our environment very seriously. It is specifically forbidden in our terms of use. This instance has since been terminated. Sep 21, 2009 www.RD1.net
  • 57. OSSEC.net OSSEC – Open Source HIDS, central logging and monitoring solution – aka SIM/SEM/SIEM Supports most platforms Linux/Unix/Windows/Mac Real-time alerting Active response - blocking of attacks Agent and Agentless monitoring File Integrity Monitoring Rootkit detection Sep 21, 2009 www.RD1.net
  • 58. Durkee Consulting, Inc. www.rd1.net [email_address] Questions?