Apache : Installation, Configuration, Basic Security

1. Apache : Installation, Configuration, Basic Security Presented by, Mr. Rahul Sharma Associate Professor ACEIT

2. Outline • Introduction • Why Apache ? • Installation • Configuration • Running Apache • Basic Security

3. Introduction • A basic web server works as follows : • It is a program that runs on a host computer . • It waits for a request from web browser/client for objects it has in its possession • Upon receiving the request (GET command from client), it retrieves the requested information and sends it to the client. The objects it can serve include HTML documents, plain text, images, sounds, video and other data.

4. Introduction • Apache is the most popular web server on the internet, running approximately 60% of all web servers. • This is the default web server on Red Hat, SuSE, and Debian systems and is well known in industry for its flexibility and performance.

5. Introduction • Installing and maintaining is easy and ranks far below email and DNS in complexity & difficulty of administration. • Its free and open source and full source code is available from Apache group site at www.apache.org

6. Why Apache ? • Apache’s popularity is due to : • Apache is highly configurable . • It is extensible (for e.g. mod_perl and mod_php3 can be added) . • Supports virtual hosts or multi homed servers . • It is free and open source .

7. Installation • Apache is included with most Linux distributions. On a machine installed with recent version of Linux, chances are Apache is already installed and running. • Processor status can be checked to see if its running by using the command machine1$ ps –ef | grep httpd

8. Installation • If one wishes to download the source code and compile it then, • Execute the configure script included with the distribution to detect type of system used and set up appropriate makefiles. • use --prefix option to specify where in ones directory tree the Apache server should live.

9. Installation • For example : % ./configure --prefix=/etc/httpd • Default modules can be used or some features may be included or removed by invoking -enable-module= and -disable-module= options to configure .

10. Installation • Some modules like asis, autoindex, env may be disabled for security reasons. • After executing configure run make and make install to actually compile and install the appropriate files .

11. Configuration • All configuration files are in conf directory ( /etc/httpd/conf). The files that are to be examined and customized are httpd.conf, srm.conf and access.conf . • httpd.conf is used to set the TCP port (usually port 80), location of log files, and various network and performance parameters

12. Running Apache • Apache can be started from machine’s rc scripts or initiated by hand with % /usr/sbin/httpd –f /etc/httpd/conf/httpd.conf • It can be started automatically at boot time by making a link in rc directory that points to /etc/init.d/httpd .

13. Security • Modifying the Default Header : • A hacker can exploit a web server by the information it sends in its header ( version, machine type, its built-up etc) . • Its always better to modify the default header by changing the lines that reveals this information in src/include/httpd.h file .

14. Security • Upgrading old software when necessary. • Protecting Web Data with IP Restrictions : • Apache can be configured to allow restricted IP addresses only. • This can be done by adding following lines in .htaccess : Order Deny, Allow Deny from All Allow from 192.168.1.100 Allow from 192.168.1.101

15. Security • Using HTTP Authentication : • HTTP user authentication restricts access to a particular directory and subdirectories of the web server . • A browser implements authentication by prompting a dialog box for the user to type his username/password.

16. Security • Using Secure HTTP Connections : • The Secure Socket Layer (SSL) should be used to minimize the likelihood that a hacker can snoop a username/password. • SSL not only encrypts the data before it is transferred to the web site, but also it decrypts the data received from the web site, thus securing the data transfers.

17. Internet Naming Service: DNS*

18. Overview • Introduction to the DNS • DNS Components • DNS Structure and Hierarchy • The DNS in Context

19. The DNS is… • The “Domain Name System” • What Internet users use to reference anything by name on the Internet • The mechanism by which Internet software translates names to attributes such as addresses

20. The DNS is also… • A globally distributed, scalable, reliable database • Comprised of three components • A “name space” • Servers making that name space available • Resolvers (clients) which query the servers about the name space

21. DNS as a Lookup Mechanism • Users generally prefer names to numbers • Computers prefer numbers to names • DNS provides the mapping between the two • I have “x”, give me “y”

22. DNS as a Database • Keys to the database are “domain names” • www.foo.com, 18.in-addr.arpa, 6.4.e164.arpa • Over 200,000,000 domain names stored • Each domain name contains one or more attributes • Known as “resource records” • Each attribute individually retrievable

23. Global Distribution • Data is maintained locally, but retrievable globally • No single computer has all DNS data • DNS lookups can be performed by any device • Remote DNS data is locally cachable to improve performance

24. Loose Coherency • Each version of a subset of the database (a zone) has a serial number • The serial number is incremented on each database change • Changes to the master copy of the database are propagated to replicas according to timing set by the zone administrator • Cached data expires according to timeout set by zone administrator

25. Scalability • No limit to the size of the database • No limit to the number of queries • Tens of thousands of queries handled easily every second • Queries distributed among masters, slaves, and caches

26. Reliability • Data is replicated • Data from master is copied to multiple slaves • Clients can query • Master server • Any of the copies at slave servers • Clients will typically query local caches • DNS protocols can use either UDP or TCP • If UDP, DNS protocol handles retransmission, sequencing, etc.

27. Dynamicity • Database can be updated dynamically • Add/delete/modify of any record • Only master can be dynamically updated • Modification of the master database triggers replication

28. Overview • Introduction to the DNS • DNS Components • The name space • The servers • The resolvers • DNS Structure and Hierarchy • The DNS in Context

29. The Name Space • The name space is the structure of the DNS database • An inverted tree with the root node at the top • Each node has a label • The root node has a null label, written as “”

30. Domain Names • A domain name is the sequence of labels from a node to the root, separated by dots (“.”s), read left to right • The name space has a maximum depth of 127 levels • Domain names are limited to 255 characters in length • A node’s domain name identifies its position in the name space

31. Subdomains • One domain is a subdomain of another if its domain name ends in the other’s domain name • So sales.nominum.com is a subdomain of • nominum.com & com • nominum.com is a subdomain of com

32. Delegation • Administrators can create subdomains to group hosts • According to geography, organizational affiliation etc. • An administrator of a domain can delegate responsibility for managing a subdomain to someone else • The parent domain retains links to the delegated subdomains

33. Delegation Creates Zones • Each time an administrator delegates a subdomain, a new unit of administration is created • The subdomain and its parent domain can now be administered independently • These units are called zones • The boundary between zones is a point of delegation in the name space • Delegation is good: it is the key to scalability

34. nominum.com domain nominum.com zone ams.nominum.com zone rwc.nominum.com zone Dividing a Domain into Zones

35. Overview • Introduction to the DNS • DNS Components • The name space • The servers • The resolvers • DNS Structure and Hierarchy • The DNS in Context

36. Name Servers • Name servers store information about the name space in units called “zones” • The name servers that load a complete zone are said to “have authority for” or “be authoritative for” the zone • Usually, more than one name server are authoritative for the same zone • This ensures redundancy and spreads the load • Also, a single name server may be authoritative for many zones

37. Name Servers and Zones 128.8.10.5 serves data for both nominum.com and isc.org zones Name Servers Zones 128.8.10.5 nominum.com 202.12.28.129 serves data for nominum.com zone only 202.12.28.129 isc.org 204.152.187.11 serves data for isc.org zone only 204.152.187.11

38. Types of Name Servers • Two main types of servers • Authoritative – maintains the data • Master – where the data is edited • Slave – where data is replicated to • Caching – stores data obtained from an authoritative server • No special hardware necessary

39. Name Server Architecture • You can think of a name server as part of: • database server, answering queries about the parts of the name space it knows about (i.e., is authoritative for), • cache, temporarily storing data it learns from other name servers, and • agent, helping resolvers and other name servers find data

40. Name Server Process Zone data file Authoritative Data (primary master and slave zones) Master server Cache Data (responses from other name servers) Agent (looks up queries on behalf of resolvers) Name Server Architecture From disk Zone transfer

41. Name Server Process Authoritative Data (primary master and slave zones) Cache Data (responses from other name servers) Agent (looks up queries on behalf of resolvers) Resolver Authoritative Data Response Query

42. Name Server Process Authoritative Data (primary master and slave zones) Cache Data (responses from other name servers) Another name server Agent (looks up queries on behalf of resolvers) Resolver Using Other Name Servers Response Response Query Query

43. Name Server Process Authoritative Data (primary master and slave zones) Cache Data (responses from other name servers) Agent (looks up queries on behalf of resolvers) Resolver Cached Data Response Query

44. Overview • Introduction to the DNS • DNS Components • The name space • The servers • The resolvers • DNS Structure and Hierarchy • The DNS in Context

45. Name Resolution • Name resolution is the process by which resolvers and name servers cooperate to find data in the name space • Closure mechanism for DNS? • Starting point: the names and IP addresses of the name servers for the root zone (the “root name servers”) • The root name servers know about the top-level zones and can tell name servers whom to contact for all TLDs

46. Name Resolution • A DNS query has three parameters: • A domain name (e.g., www.nominum.com), • Remember, every node has a domain name! • A class (e.g., IN), and • A type (e.g., A) • Upon receiving a query from a resolver, a name server • 1) looks for the answer in its authoritative data and its cache • 2) If step 1 fails, the answer must be looked up

47. The Resolution Process • Let’s look at the resolution process step-by-step: annie.west.sprockets.com ping www.nominum.com.

48. What’s the IP address of www.nominum.com? The Resolution Process • The workstation annie asks its configured name server, dakota, for www.nominum.com’s address dakota.west.sprockets.com annie.west.sprockets.com ping www.nominum.com.

49. What’s the IP address of www.nominum.com? The Resolution Process • The name server dakota asks a root name server, m, for www.nominum.com’s address m.root-servers.net dakota.west.sprockets.com annie.west.sprockets.com ping www.nominum.com.

50. Here’s a list of the com name servers. Ask one of them. The Resolution Process • The root server m refers dakota to the com name servers • This type of response is called a “referral” m.root-servers.net dakota.west.sprockets.com annie.west.sprockets.com ping www.nominum.com.