HTTP Server Prone To Slow Denial Of Service Attack

1. For Apache HTTPD Server:
Upgrade to the latest version that has "mod_reqtimeout" module support available by default.
Then enable the module "mod_reqtimeout" and configure it to set the timeout and minimum data rate for receiving requests,

See my screenshot below

RequestReadTimeout header=10-20,minrate=500
RequestReadTimeout body=10,minrate=500

For a complete write-up see Using mod_reqtimeout to make HTTP Server less vulnerable for DOS Attack for CentOS

References:

1. Apache Module mod_reqtimeout
2. Using mod_reqtimeout to make HTTP Server less vulnerable for DOS Attack for CentOS

Adding SVG MIME Type to Apache on CentOS

What is MIME?

According to www.w3.org/services/svg-server

MIME Types (sometimes referred to as "Internet media types") are the primary method to indicate the type of resources delivered via MIME-aware protocols such as HTTP and email. User agents (such as browsers) use media types to determine whether that user agent supports that specific format, and how the content should be processed. When an SVG document is not served with the correct MIME Type in the Content-Type header, it might not work as intended by the author; for example, a browser might render the SVG document as plain text or provide a "save-as" dialog instead of rendering the image.

Step 1: To add SVG MIME as list of supported MIME Type, simply add these lines to your /etc/httpd/conf/httpd.conf. I have placed it at around line 786

#
# AddType allows you to add to or override the MIME configuration
# file mime.types for specific file types.
#
#AddType application/x-tar .tgz
AddType image/svg+xml svg svgz
AddEncoding gzip svg

Step 2: One more thing do ensure you have the following line at your /etc/mime.type

image/svg+xml svg svgz

Step 3. Remember to restart the Apache

# service httpd restart 

Checking loaded apache modules

To check loaded apache modules, you can take a look at

#  apachectl -M

OR

# apache2ctl -M

core_module (static)
mpm_prefork_module (static)
http_module (static)
so_module (static)
auth_basic_module (shared)
auth_digest_module (share)
.....
.....
.....

.....
reqtimeout_module (shared)
php5_module (shared)

Apache Server Setting Mistakes Can Aid Hackers

This article from Michael J. Schwartz on InfomationWeek titled Apache Server Setting Mistakes Can Aid Hackers

According to a study of 10 million websites released last week, more than 2,000 sites -- including big-name businesses such as Cisco, Ford and Staples -- have left the status pages for their Apache servers visible, which could give attackers information that would help them penetrate corporate networks.
.......
.......
According to Apache documentation, the Apache mod_status module "allows a server administrator to find out how well their server is performing," via an HTML page that delivers up-to-date server statistics. "It is basically an HTML page that displays the number of [processes] working, status of each request, IP addresses that are visiting the site, pages that are being queried and things like that. All good," said Cid in a related blog post. 

"However, this feature can also have security implications if you leave it wide open to the world. Anyone would be able to see who is visiting the site, the URLs and sometimes even find hidden -- obscure -- admin panels or files that should not be visible to the outside," he said. "That can help attackers easily find more information about these environments and use them for more complex attacks." 

......
......
For more information, I encourage to read the full article on Apache Server Setting Mistakes Can Aid Hackers

Enabling Server Side Includes - SSI on Apache 2

Enabling Server Side Include for Apache is a very simple process.

First thing first, you have to includes make sure APache knows which file to be parsed with should be parsed using SSI

At /etc/httpd/conf/httpd.conf, ensure the following has been done.

AddType text/html .shtml
AddHandler server-parsed .shtml

The next thing is to ensure that the Directory Section of the Apache where the .shtml reside should contains this. This is epsecially true if you set the AllowOverride

<Directtory /home/tester/public_html>
Options +Includes
AllowOverride All
Order allow,deny
Allow from all
</Directory >

For more information and resources, see

1. Apache Module mod_include
2. Why my Apache Server Side Include (SSI) is not working?

Apache only serving last virtual host?

I'm assuming that you have registered your various Domain Name with your respective ISP.
I was configuring my Apache to add 1 VirtualHost and in the end, even though I follow the standard configuration of adding Virtual Host, my original default ServerName was replaced by the VirtualHost ServerName. This was strange indeed. I realised that the issue is due to the missing IP Address for NameVirtualHost.

NameVirtualHost 192.168.1.1:80

<VirtualHost www.mydomain.com:80>
  DocumentRoot /var/www/html
  ServerName www.mydomain.com
  ServerAlias www1.mydomain.com
  ErrorLog /var/log/httpd/mydomain/error_log
  CustomLog /var/log/httpd/mydomain/access_log common
</VirtualHost>


<VirtualHost www.yourdomain.com:80>
  DocumentRoot /home/yourdomain/public_html
  ServerName www.yourdomain.com
  ServerAlias www1.yourdomain.com
  ErrorLog /var/log/httpd/yourdomain/error_log
  CustomLog /var/log/httpd/yourdomain/access_log common
</VirtualHost>

Restart the httpd Services

# service httpd restart

For more reference, see Apache Name Based VirtualHost Example

Turning off SSL engine in Apache for CentOS

Turning off SSL engine in Apache is very easy and straightforward, just go to

1. Edit ssl.conf

# vim /etc/httpd/conf.d/ssl.conf

2. Find a line SSLEngine and turn it to off

#   SSL Engine Switch:
#   Enable/Disable SSL for this virtual host.
SSLEngine off

3. Restart the Httpd Services

# service httpd restart

SSL/TTL strong encryption How to from Apache

I was browsing on Apache Document Website and like this How-To tutorial "SSL/TLS Strong Encryption: How-To". Previously I have blog an entry on How to disable SSLv2 and Weak Cipers and enable SSLv3 on Linux . This How-To from Apache can be easily adapted to similar settings.

Here are some excerpts from the How-To


1. Create a real SSLv2-only server?

The following creates an SSL server which speaks only the SSLv2 protocol and its ciphers.
httpd.conf

SSLProtocol -all +SSLv2
SSLCipherSuite SSLv2:+HIGH:+MEDIUM:+LOW:+EXP

2. How can I create an SSL server which accepts strong encryption only?

The following enables only the seven strongest ciphers:
At /etc/httpd/conf/httpd.conf

SSLProtocol all
SSLCipherSuite HIGH:MEDIUM

3. Accepts All types of cipher in general, but requires strong cipher for access to particular URL.

At /etc/httpd/conf/conf.d/ssl.conf

# (liberal in general for all cipher)

SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

# But at the particular directory which require strong encryption

<Location /strong/area>
# but https://hostname/strong/area/ and below
# requires strong ciphers
SSLCipherSuite HIGH:MEDIUM
</Location>

How to disable SSLv2 and Weak Cipers and enable SSLv3 on Linux

In order to be Payment Card Industry Data Security Standard PCI-DSS) Compliance v1.2, we are required to use “use strong cryptography and security protocols such as SSL/TLS or IPSEC to safeguard sensitive cardholder data during transmission over open, public networks.”

Secure Socket Layer (SSL) version 2 is considered weak cryptography in this aspect. To disabled SSLv2 and enable SSLv3. Assuming you already have OpenSSL installed, you can use another remote server to test the https connections

# openssl s_client -ssl2 -connect remote_server:443

If your server does not support SSLv2, you should receive the following error

CONNECTED(00000003)
22255:error:1407F0E5:SSL routines:SSL2_WRITE:ssl handshake failure:s2_pkt.c:428:

If your server is enabled to supports SSLv2 connections, the connection will be accepting input

CONNECTED(00000003)

 To use SSLv3 and TLSv1, you have to modify the following at SSLCipherSuite directive in the httpd.conf or /etc/httpd/conf.d/ssl.conf file. In the example, you can do the following

#SSLProtocol all -SSLv2
SSLProtocol -all +SSLv3 +TLSv1

On my /etc/httpd/conf.d/ssl.conf

SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM

For more information,see

1. How to Disable SSLv2 and Weak Ciphers(PCI Compliance (http://almamunbd.blogspot.com)
2. How to Disable SSLv2 and Weak Ciphers(PCI Compliance (http://www.srcnix.com)

Important Apache (httpd) security Update

An important security update for httpd and solution for

1. 'Devastating' Apache bug leaves servers exposed
2. Apache released 2nd workaround for Devastating' Apache bug

Description of the bugs can be found at CVE-2011-3192

The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.

Solution:

# yum update httpd

Avoiding DNS Lookup for Apache 2

If you wish to avoid situations where you do not wish to do DNS lookup for the client machines which will slow Apache performance. To do it is quite quick by setting the HostNameLookups directive to off at /etc/httpd/conf/httpd.conf

HostNameLookups Off

Apache released 2nd workaround for Devastating' Apache bug

Apache had release 2nd update but no solution yet for the 'Devastating' Apache bug leaves servers exposed . For more information on the 2nd update, see
http://mail-archives.apache.org/mod_mbox/httpd-announce/201108.mbox/%3C20110826103531.998348F82@minotaur.apache.org%3E

Finally a solution is provided. See Important Apache (httpd) security Update

'Devastating' Apache bug leaves servers exposed

'Devastating' Apache bug leaves servers exposed

Devs race to fix weakness disclosed in 2007

By Dan Goodin in San Francisco 

Posted in Security, 24th August 2011 18:05 GMT

Maintainers of the Apache webserver are racing to patch a severe weakness that allows an attacker to use a single PC to completely crash a system and was first diagnosed 54 months ago.

Attack code dubbed “Apache Killer” that exploits the vulnerability in the way Apache handles HTTP-based range requests was published Friday on the Full-disclosure mailing list. By sending servers running versions 1.3 and 2 of Apache multiple GET requests containing overlapping byte ranges, an attacker can consume all memory on a target system.

“The behaviour when compressing the streams is devastating and can end up in rendering the underlying operating system unusable when the requests are sent parallely,” Kingcope, the researcher credited with writing and publishing the proof-of-concept attack code wrote Wednesday on Apache's Bugzilla discussion list. “Symptoms are swapping to disk and killing of processes including but solely httpd processes.”

The denial-of-service attack works by abusing the routine web clients use to download only certain parts, or byte ranges, of an HTTP document from an Apache server. By stacking an HTTP header with multiple ranges, an attacker can easily cause a system to malfunction. On Wednesday morning, Apache developers said they expect to release a patch in the next 96 hours.

The Apache advisory contains several workarounds that admins can deploy in the meantime.

The susceptibility of Apache's range handling to crippling DoS attacks was disclosed in January 2007 Michal Zalewski, a security researcher who has since taken a job with Google. He said at the time that both Apache and Microsoft's competing IIS webserver were vulnerable to crippling DoS attacks because of the programs' “bizarro implementation” of range header functionality based on the HTTP/1.1 standard.

“Combined with the functionality of window scaling (as per RFC 1323)), it is my impression that a lone, short request can be used to trick the server into firing gigabytes of bogus data into the void, regardless of the server file size, connection count, or keep-alive request number limits implemented by the administrator,” Zalewski wrote. “Whoops?”

In an email to The Register on Wednesday, Zalewski wrote: “Not sure why they haven't done something about it back then, probably just haven't noticed in absence of an exploit.”

The episode challenges the conventional wisdom repeated by many proponents of open-source software that flaws in freely available software get fixed faster than in proprietary code because everyday users are free to inspect the source code and report any vulnerabilities they find. Assuming that claim is true, the four-year weakness in Apache's range-handling feature would appear to be an obvious exception.

About 235 million websites use Apache, making it the most widely used webserver with about 66 percent of the entire internet, according to figures released last month by Netcraft. IIS ranked second with more than 60 million sites, or about 17 percent.

In a statement issued several hours after this article was published, Microsoft spokesman Jerry Bryant said: "IIS 6.0 and later versions are not susceptible to this type of denial-of-service due to built in restrictions." ®

Update

Trustwave's SpiderLabs has provided a detailed technical analysis here along with instructions for mitigating attacks using the open-source ModSecurity firewall.

Setting up self-signed SSL certificate for Apache on CentOS 5

To set up self-signed SSL certificate for Apache on CentOS 5, do the following

1. Create a self-signed certificate

# make /etc/pki/tls/certs/self_signed_cert.pem

2. Enter the information such as country, province, state, company, division etc. These information will be reflected in your self-signed certificate

3. Configure the ssl configuration

# vim /etc/httpd/conf.d/ssl.conf

4. Update ssl.conf, ensure SSLCACertificateFile and SSLCACertificateKeyFile points to the newly created self-signed certificate

...........
SSLCACertificateFile /etc/pki/tls/certs/self_signed_cert.pem
SSLCACertificateKeyFile /etc/pki/tls/certs/self_signed_cert.pem
..........

5. Restart the httpd service

# service httpd restart

6. Check your https :)

Enabling CGI on Apache 2.x

For more information, do ready up the Apache Tutorial: Dynamic Content with CGI which provides with a easy-to-read configuration if you wish to enable CGI on the Apache 2.x


The ScriptAlias directive tells Apache that a particular directory is set aside for CGI programs. Apache will assume that every file in this directory is a CGI program, and will attempt to execute it, when that particular resource is requested by a client.

ScriptAlias /cgi-bin/ /usr/local/apache2/cgi-bin/

Explicitly using Options to permit CGI execution

You could explicitly use the Options directive, inside your main server configuration file, to specify that CGI execution was permitted in a particular directory:

<Directory /usr/local/apache2/htdocs/somedir>
Options +ExecCGI
AddHandler cgi-script .cgi .pl
</Directory>

User Directories
To allow CGI program execution for any file ending in .cgi in users' directories with a cgi-bin extension, you can do the following:

<Directory /home/*/public_html/cg-bin>
Options +ExecCGI
AddHandler cgi-script .cgi .pl
</Directory>

Loading Mod_Python on Apache 2.x on CentOS 4.x and CentOS 5.x

Loading Python on Apache is easy. The material is taken from Mod Python ArchLinux Wiki

Configure Apache

# vim /etc/httpd/conf/httpd.conf

LoadModule python_module modules/mod_python.so

Restart Apache

# service restart httpd

Test Mod_Python
1. Add this block to /etc/httpd/conf/httpd.conf

<Directory /home/www/html> 
   AddHandler mod_python .py
   PythonHandler mod_python.publisher 
   PythonDebug On 
</Directory>

2. Create a file in /home/www/html/ called mptest.py and add this as contents

from mod_python import apache
def handler(req):
req.content_type = 'text/plain'
req.send_http_header()
req.write("Hello World!")
return apache.OK

Restart Apache again

# service restart httpd

Navigate to http://www.yoursite.com/mphandler.py/handler and you should see a site that says
Hello World!

Welcome.conf and Apache Default web Page

In CentOS and Fedora, the default Document Root is /var/www/html. If the user does not have a index.htm page in their directory, Apache will show a web page "Apache 2 Test Page" Power by CentOS

I think you may ask where is the web page coming from since there is no starting web page. To locate this "
"starting page", go to

# less /etc/httpd/conf.d/welcome.conf

The easier way to "remove" the Default Web Page is by creating a starting web page or a redirect web page