Apache: Ein kleiner Schutz vor Schwachstellen Scanner

Ein kleiner Schutz vor Schwachstellen Scanner: w00tw00t.at.ISC.SANS.DFind

apt-get install fail2ban


/etc/fail2ban/jail.conf

#####
# HTTP
####

[apache-404]
enabled = true
port = http,https
filter = apache-404
logpath = /var/log/apache*/*error.log
maxretry = 3

[block_ww0twt]
enabled = true
port = http,https
filter = apache-404
logpath = /var/log/apache*/*error.log
maxretry = 3


/etc/fail2ban/filter.d/apache-404.conf

# Fail2Ban configuration file
#
# License: GPL
# You are free to Use this on other Sites if you link back to this Site.
#
[Definition]
# Option: failregex
# Notes.: regex to match the "File does not exist" messages in the logfile. The
# host must be matched by a group named "host". The tag "" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P\S+)
# Values: TEXT
#

failregex = [[]client (?P\S*)[]] File does not exist: *

#

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# standart search for favicon.ico and robots.txt - this is often thrown and may do stupid mistakes
# Values: TEXT
#
ignoreregex = .*(robots.txt|favicon.ico)


/etc/fail2ban/filter.d/block_ww0twt.conf

# Fail2Ban configuration file
#
# License: GPL
# You are free to Use this on other Sites if you link back to this Site.
#
[Definition]
# Option: failregex
# Notes.: regex to match the "File does not exist" messages in the logfile. The
# host must be matched by a group named "host". The tag "" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P\S+)
# Values: TEXT
#

#failregex = [[]client (?P\S*)[]] client sent HTTP/1.1 request without hostname *
failregex = [[]client (?P\S*)[]] client sent HTTP/1.1 request without hostname \(see RFC2616 section 14.23\): \/w00tw00t.*

#

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# standart search for favicon.ico and robots.txt - this is often thrown and may do stupid mistakes
# Values: TEXT
#
ignoreregex = .*(robots.txt|favicon.ico)






block_ww0twt_2.conf

# Fail2Ban configuration file
#
# License: GPL
# You are free to Use this on other Sites if you link back to this Site.
#
[Definition]
# Option: failregex
# Notes.: regex to match the "File does not exist" messages in the logfile. The
# host must be matched by a group named "host". The tag "" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P\S+)
# Values: TEXT
#

#failregex = [[]client (?P\S*)[]] client sent HTTP/1.1 request without hostname *
failregex = [[]client (?P\S*)[]] script .* not found or unable to stat

#

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# standart search for favicon.ico and robots.txt - this is often thrown and may do stupid mistakes
# Values: TEXT
#
ignoreregex = .*(robots.txt|favicon.ico)

Backup / Restore MySQL

MySQL-Backup Script
-------------------

#!/bin/bash

/path/to/mysqldump -u USER DBNAME > /path/to/backupdir/DBNAME.sql


z.B.

/usr/bin/mysqldump -u backup mysql > /var/www/backup/mysql.sql
/usr/bin/mysqldump -u backup joomla > /var/www/backup/joomla.sql




Mounten von Samba/Windows Shares
---------------------------------

/etc/samba/cred.txt
username=user
password=password


/etc/fstab

//SERVER/SHARE /media/MOUNTPONINT cifs credentials=/etc/samba/cred.txt 0 0


z.B:

//192.168.1.200/www /media/srv01 cifs credentials=/etc/samba/cred.txt 0 0





Datum und Uhrzeit in Variable schreiben
---------------------------------------


date +%Y%m%d-%H%M%S


FILEDATE=`date +%Y%m%d-%H%M%S`



z.B.

/usr/bin/mysqldump -u backup mysql > /var/www/backup/mysql-$FILEDATE.sql

Versionsinfo abschalten apache & php

/etc/apache2/apache2.conf


# ScriptAlias /cgi-bin/ "/usr/local/apache2/cgi-bin/"
LogLevel notice


Options -FollowSymLinks -Includes -Indexes -MultiViews
#
#
#



/etc/apache2/sites-available/default
# ErrorLog
# CustomLog


/etc/apache2/conf.d/security


ServerTokens Prod
ServerSignature Off
TraceEnable Off



/usr/include/apache2/ap_release.h
#define AP_SERVER_BASEVENDOR "Restricted server"
#define AP_SERVER_BASEPRODUCT "Secure Web Server"




---------


httpd.conf

ServerTokens Prod
ServerSignature Off



php.ini


expose_php = Off
display_errors=Off
register_globals = Off


bei SuSE mit apache v2.xx und php5


/etc/php5/apache2/php.ini

expose_php = Off
display_errors=Off
register_globals = Off



/etc/sysconfig/apache2

APACHE_SERVERTOKENS="Prod"
APACHE_SERVERSIGNATURE="off"

Verzeichnisschutz Apache

Alle verzeichnisse ab /html/ nicht mehr Indexieren


Options -Indexes



Indexierung in diesem einem Verz. /info zulassen


Options +Indexes

Umlaute in MySQL / Apache

Apache (httpd.conf)


AddDefaultCharset LATIN1
AddDefaultCharset ISO-8859-1



MySQL (my.cnf)

[mysqld]

character-set-server = latin1
default-character-set=latin1
collation-server=latin1_german1_ci

[client]

default-character-set=latin1