Discuss

discuss@lists.centos.org

34753 discussions

Re: [CentOS] Apache security , Was: Running Apache sites as separate users
by Trey Dockendorf 02 Oct '11

02 Oct '11

On Thu, Sep 29, 2011 at 9:35 PM, Lucian <lucian(a)lastdot.org> wrote: > On Fri, Sep 30, 2011 at 2:22 AM, Trey Dockendorf <treydock(a)gmail.com> > wrote: > > I had a recent request to improve security on my web servers by having > each > > website use a different user to run the hosting service. So > > example1.comhas it's own Apache instance running as apache1 and then > > example2.com has its own instance of Apache as apache2. Is this even > > possible or realistic? I understand the idea of how that would be > secure, > > much like creating a virtual machine to segregate services. The only way > I > > can think how this is done is to chroot each website. What makes this > > request even stranger is that each website will be managed by the same > CMS > > and code base. So with that being the case, I don't see how this is > > possible. Any ideas or insight are very welcome. > > Is there a specific requirement to run different http servers? Because > if there is not then you can just use Suexec+fastcgi. > Otherwise, just use Apache to proxy stuff to backend servers (can be > anything from apache to nginx). > > HTH > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos > I do not know the exact reasoning for wanting each website to be run by a separate Apache process that has it's own user. Likely it's a misunderstanding of actual threats to websites, or using a IIS mindset to set requirements for Apache. I'll give Suexec+fastcgi a look and mod_ruid. Thanks for those suggestions While on subject of Apache security... Another request / idea was to have this CMS under development write user controls to .htaccess files to restrict download access to directories. Typically if I even allow any overrides, I set it so apache can only read .htaccess. My understanding of the more obvious implications is that if the web server can write to .htaccess so can any attacker, and then can easily inject malware or redirect the site to malicious content. Is there ever a case where it's safe to allow write access by apache to .htaccess? Does the below config for .htaccess in httpd.conf protect from this at all if write permissions were given on the file system? <Files ~ "^\.htaccess"> Order allow,deny Deny from all Satisfy All </Files> Personally I think that the CMS should handle authorization, and at then possibly rely on Apache for authentication. In the case of this CMS it will be authenticating against a campus SSO through CAS, but access has to be restricted based on user lists. - Trey

2 1

email
by siddhesh samant 02 Oct '11

02 Oct '11

linux879(a)gmail.com

1 0

Tool to track files
by Fajar Priyanto 02 Oct '11

02 Oct '11

Hi all, Due to some reason, I will have to stop using Samba as our fileserver, and instead replace it with SSH access only. Users will be able to use WinSCP for it. The question is, is there any tool to track files (what is new files, deleted files by who, etc)? In Samba I can do that. I don't know how if it's SSH access. Thank you Fajar.

2 1

Openvz inside a KVM guest?
by Bob Hoffman 02 Oct '11

02 Oct '11

Open vz is a container VM....software, not hardware dependent. Is is possible to make a server a centos 6 KVM host, install centos 6 as a guest system... and then install openvz (or something like that) in the guest OS? thus instead of two websites each with its own guest image, you can put both inside the guest and still have them kind of sandboxed? or is that crazy?

1 0

add on sata card relabeling drives, installation
by Bob Hoffman 01 Oct '11

01 Oct '11

Hi all. I have a new server and am playing with the installation. (centos 6). My onboard sata card has 6 drives attached to it, yet the server has 8 bays. I bought a sata controller card (adaptec) and added it to the mix, adding two more drives. Everything works and all is accessible, but there is one annoying issue. When installing with anaconda, the 2 drives located on the add-on sata card are being listed as sda and sdb instead of going to the back of the line. I would rather my a and b drives be the 0 and 1 sata ports of the onboard controller, but it seems the add-on is taking priority. My only thought is to install without the 2 drives connected and then add them afterwords. But again, that makes no sense to have to do it that way. Is this just normal for the add on sata cards? If I add the drives to the system after I install it all, will linux barf on it and change the drive letters? I do not want my raid 1 mirror OS to be on sdc, sdd, and sde....it just looks weird. thanks

12 37

udev-devel or libudev-devel on CentOS 5.6
by Kaushal Shriyan 01 Oct '11

01 Oct '11

Hi, Is there libudev-devel or udev-devel package available on CentOS 5.6 ? [root@~]# yum search udev-devel Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: centos.aol.in * extras: centos.aol.in * updates: centos.aol.in base | 1.1 kB 00:00 extras | 2.1 kB 00:00 updates | 1.9 kB 00:00 Warning: No matches found for: udev-devel No Matches found [root@~]# yum search libudev-devel Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: centos.aol.in * extras: centos.aol.in * updates: centos.aol.in Warning: No matches found for: libudev-devel No Matches found [root@~]# Regards Kaushal

2 3

innovation of micro$oft...
by lancebaynes87 01 Oct '11

01 Oct '11

http://chrome.blogspot.com/2011/09/problems-with-microsoft-security.html It was just an accident, or not, mr. micro$oft? ...f*ck you..

3 2

CentOS 6 and NIS not working
by Martyn Klassen 30 Sep '11

30 Sep '11

I am having no luck getting NIS to work on a clean install of CentOS 6. It seems to be an issue with ypbind. I have simple /etc/yp.conf which explicitly sets the server domain myDomain server myServer The service seems to start okay #service ypbind start Starting NIS service: [OK] Binding NIS service: … [OK] But when I try to use any of the yp services, like ypwhich #ypwhich ypwhich: Can't communicate with ypbind This is usually blamed on ypbind not running, but ypbind is confirmed to be running #ps -ef | grep ypbind root 3033 1 0 15:11 ? 00:00:00 /usr/sbin/ypbind ypcat also does not work #ypcat netgroup No such map net group. Reason: Can't bind to the server which serves this domain I have double checked that the server is running #rpcinfo -u myServer ypserv program 100004 version 1 ready and waiting program 100004 version 2 ready and waiting The domain name seems to be set correctly as well #domainname myDomain I have tried disabling iptables and selinux, but that has no effect. I am probably missing something obvious, but NIS has never given me these issues before. Any suggestions on what might be the culprit? Martyn

2 2

Running Apache sites as separate users
by Trey Dockendorf 30 Sep '11

30 Sep '11

I had a recent request to improve security on my web servers by having each website use a different user to run the hosting service. So example1.comhas it's own Apache instance running as apache1 and then example2.com has its own instance of Apache as apache2. Is this even possible or realistic? I understand the idea of how that would be secure, much like creating a virtual machine to segregate services. The only way I can think how this is done is to chroot each website. What makes this request even stranger is that each website will be managed by the same CMS and code base. So with that being the case, I don't see how this is possible. Any ideas or insight are very welcome. Thanks - Trey

11 14

ssh -D socks proxy through CentOS-5
by James B. Byrne 30 Sep '11

30 Sep '11

Is there anything special in the way of configuration that is required to enable a CentOS box to act as the point of origin for an http request routed to it via a SOCKS ssh link? I have researched this matter and the recommended procedure is to open an SSH connection to the desired host passing the requisite switches so: ssh -f -n -D <port> user(a)host.domain.tld And then reconfigure the desired applications to use the localhost:<port> as the SOCKS proxy. However, I cannot seem to get this to work with my CentOS based desktop to which I am trying to connect through a public wireless network. I connect to the desktop via terminal (on OSX-10.6.8 fine), but setting the browser, Firefox-3.6.23, advanced network config to use localhost:<port> as a SOCKSv5 proxy for http simply results in the browser failing to show anything. I do not get any error, I just get a blank page for whatever url I try. I have tried this with and without the iptables service running on the target and achieved the same results. Therefore I do not consider the firewall configuration on the target to be the immediate problem. Has anyone here tried to do this and succeeded? Supplemental question: How does one route an https connection to a non-standard port via SOCKS? How does one configure a browser to do this? -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

2 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss