Apache Virtual Host Configuration Linux

The term Virtual Host refers to the practice of running more than one web site (such as www.linunix.in and www.example.com) on a single machine. Virtual hosts can be "IP-based", meaning that you have a different IP address for every web site, or "name-based", meaning that you have multiple names running on each IP address. The fact that they are running on the same physical server is not apparent to the end user.

Apache was one of the first servers to support IP-based virtual hosts right out of the box. Versions 1.1 and later of Apache support both IP-based and name-based virtual hosts (vhosts). The latter variant of virtual hosts is sometimes also called host-based or non-IP virtual hosts.

IP-BASED VIRTUAL HOST:

In this configuration, If we are pointing two websites (with different ip-address) to the server that runs Apache, that physical server should have two different ip-address configured.This means that the server should have two ethernet cards, each one of them configured to the ip-address of the corresponding website that Apache virtual host will be serving. So, this is not practical for most aspects, and you should not be using this.

NAME-BASED VIRTUAL HOSTS:

In this configuration, When Apache web server receives a request, it looks for the host name in the header, and depending on the hostname , it serves different websites.This is very easy and also you need only one ip address  on that physical server but needs to update the DNS with multiple website names pointing to same ip address.

[root@linunix.in ~]# mkdir /var/www/linunix.in/index.html

[root@linunix.in ~]# mkdir /var/www/example.com/index.html

 We need to mention the Apache web server ip address on the below location.

[root@linunix.in ~]# vi /etc/httpd/conf/httpd.conf

Search for NameVirtualHost and uncomment this line by removing the # and add the IP to which you want to receive Apache requests as below

NameVirtualHost        * : 80

Now, it’s time to setup Virtual host sections for your domains, move to the bottom of the file by pressing Shift + G. Here in this example, we are setting up virtual host sections for two domains

www.linunix.in  & www.example.com

Add the following two virtual directives at the bottom of the file. Save and close the file.

Read More

Apache Hardening Linux

Web Server is  crucial part of any web-based applications.Apache Web Server is often placed at the edge of the network hence it becomes one of the most vulnerable services to attack. Having default configuration supply many sensitive information which may help hacker to prepare for an attack the web server.
The majority of web application attacks are through XSS, Info Leakage, Session Management and PHP Injection attacks which is due to weak programming code and failure to sanitize web application infrastructure.

Steps for the same:

Disabling Apache Version and OS Identity:

Open the httpd configuration file and place below lines as mentioned.

# vi /etc/httpd/conf/httpd.conf

#####Server Banner######  

ServerSignature Off                                                 

ServerTokens Prod

Disabling Document Root Directory Content List:

To disable the content of document root directory listing(Index pages), please place the place the below rules in httpd configuration file

# vi /etc/httpd/conf/httpd.conf

                                      

Upgrade the Apache Server regularly  to newer version:

Upgrade the apache web servers regularly,because every time new versions of software releasing in the market due to security vulnerabilities.

# yum update httpd

# rpm -Uvh httpd-xx.xx-xxx.rpm

Disable Trace Requests:

This is needed to disable the trace request and add the below lines in the httpd configuration file.

# vi /etc/httpd/conf/httpd.conf

########Disable Trace Requests########

TraceEnable off

Security Fixes:

We need to add some rewrite engines rules in order to secure our productions web servers. Below lines needs to be added in the httpd configuration file.

# vi /etc/httpd/conf/httpd.conf

######Security Fixes######  

RewriteEngine on

RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)

RewriteRule .* - [F]

After doing the changes, you need to restart the apache server as follows.

# Service httpd restart   

or 

# /etc/init.d/httpd restart

Read More

WordPress Installation Linux

Wordpress is a free and open source website and blogging tool that uses php and MySQL. 

Setup:

Before working with wordpress, you need to have LAMP installed on your server. If you don't have the Linux, Apache, MySQL, PHP stack on your server, you can find the tutorial for setting it up here.

Once you have the user and required software, you can start installing wordpress!

Download WordPress:

We can download Wordpress straight from their website:

wget http://wordpress.org/latest.tar.gz

This command will download the zipped wordpress package straight to your user's home directory. You can unzip it the the next line:

tar -xzvf latest.tar.gz 

Create the WordPress Database and User:

After we unzip the wordpress files, they will be in a directory called wordpress in the home directory.

Now we need to switch gears for a moment and create a new MySQL directory for wordpress.

Go ahead and log into the MySQL Shell:

mysql -u root -p

Login using your MySQL root password, and then we need to create a wordpress database, a user in that database, and give that user a new password. Keep in mind that all MySQL commands must end with semi-colon. First, let's make the database (I'm calling mine wordpress for simplicity's sake; feel free to give it whatever name you choose):

CREATE DATABASE wordpress;
Query OK, 1 row affected (0.00 sec)

Then we need to create the new user. You can replace the database, name, and password, with whatever you prefer:

CREATE USER wordpressuser@localhost;
Query OK, 0 rows affected (0.00 sec)

Set the password for your new user:

SET PASSWORD FOR wordpressuser@localhost= PASSWORD("password");
Query OK, 0 rows affected (0.00 sec)

Finish up by granting all privileges to the new user. Without this command, the wordpress installer will not be able to start up:

GRANT ALL PRIVILEGES ON wordpress.* TO wordpressuser@localhost IDENTIFIED BY 'password';
Query OK, 0 rows affected (0.00 sec)

Then refresh MySQL:

FLUSH PRIVILEGES;
Query OK, 0 rows affected (0.00 sec)

Exit out of the MySQL shell:

exit

Setup the WordPress Configuration:

The first step to is to copy the sample wordpress configuration file, located in the wordpress directory, into a new file which we will edit, creating a new usable wordpress config:

cp ~/wordpress/wp-config-sample.php ~/wordpress/wp-config.php

Then open the wordpress config:

vi ~/wordpress/wp-config.php

Find the section that contains the field below and substitute in the correct name for your database, username, and password:

// ** MySQL settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define('DB_NAME', 'wordpress');

/** MySQL database username */
define('DB_USER', 'wordpressuser');

/** MySQL database password */
define('DB_PASSWORD', 'password');

Save and Exit.

Copy the Files:

We are almost done uploading Wordpress to the server. The final move that remains is to transfer the unzipped WordPress files to the website's root directory.

sudo cp -r ~/wordpress/* /var/www/html

From here, WordPress has its own easy to follow installation form online.

However, the form does require a specific php module to run. If it is not yet installed on your server, download php-gd:

sudo yum install php-gd

Last of all restart Apache:

 sudo service httpd restart

 Access the WordPress Installation:

Once that is all done, the wordpress online installation page is up and waiting for you:

Access the page by adding /wp-admin/install.php to your site's domain or IP address (eg. example.com/wp-admin/install.php) and fill out the short online form (it should look likethis).

Read More

Configuring SSL Certificates on Apache - CentOS

A SSL certificate is a way to encrypt a site's information and create a more secure connection. Additionally, the certificate can show the virtual private server's identification information to site visitors. Certificate Authorities can issue SSL certificates that verify the virtual server's details while a self-signed certificate has no 3rd party corroboration.

Install Mod SSL:

In order to set up the self signed certificate, we first have to be sure that Apache and Mod SSL are installed on our VPS. You can install both with one command:

yum install mod_ssl

Step Two—Create a New Directory

Next, we need to create a new directory where we will store the server key and certificate

mkdir /etc/httpd/ssl 

Step Three—Create a Self Signed Certificate

When we request a new certificate, we can specify how long the certificate should remain valid by changing the 365 to the number of days we prefer. As it stands this certificate will expire after one year.

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/httpd/ssl/apache.key -out /etc/httpd/ssl/apache.crt

With this command, we will be both creating the self-signed SSL certificate and the server key that protects it, and placing both of them into the new directory.

This command will prompt terminal to display a lists of fields that need to be filled in.

The most important line is "Common Name". Enter your official domain name here or, if you don't have one yet, your site's IP address.

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [IN]:IN
State or Province Name (full name) [Some-State]:TN
Locality Name (eg, city) []:HYD
Organization Name (eg, company) [Linunix Technologies Pvt Ltd]:Linunix.in
Organizational Unit Name (eg, section) []:IT
Common Name (e.g. server FQDN or YOUR name) []:example.com                  
Email Address []:webmaster@example.com

Step Four—Set Up the Certificate

Now we have all of the required components of the finished certificate.The next thing to do is to set up the virtual hosts to display the new certificate.

Open up the SSL config file:

 vi /etc/httpd/conf.d/ssl.conf

Find the section that begins with and make some quick changes.

Uncomment the DocumentRoot and ServerName line and replace example.com with your DNS approved domain name or server IP address (it should be the same as the common name on the certificate):

 ServerName example.com:443

Find the following three lines, and make sure that they match the extensions below:

SSLEngine on
SSLCertificateFile /etc/httpd/ssl/apache.crt
SSLCertificateKeyFile /etc/httpd/ssl/apache.key 

Your virtual host is now all set up! Save and Exit out of the file.

Step Five—Restart Apache

You are done. Restarting the Apache server will reload it with all of your changes in place.

 /etc/init.d/httpd restart

In your browser, type https://youraddress to view the new certificate.

Read More

Apache's mod_evasive Installation and configuration CentOS,Debian,Ubuntu

Installation on Debian / Ubuntu

The installation of mod_evasive in a Debian / Ubuntu is identical. Before we go any steps further with the installation, make sure you have an up-to date system by issuing:

# apt-get update 

# apt-get upgrade --show-upgraded

Next, install Apache’s module mod_evasive by executing:

# apt-get install libapache2-mod-evasive -y

Once the installation is finished, execute the following commands to configure Apache to use mod_evasive module:

# cat >> /etc/httpd/conf.d/mod_evasive.conf <
DOSHashTableSize 3097
DOSPageCount 5
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 60
DOSEmailNotify your@email.com
DOSLogDir /var/log/apache2/evasive

EOF

# chown www-data: -R /var/log/apache2/

# /etc/init.d/apache2 restart

---

=> Installation on CentOS 5

First, make sure your CentOS 5  is fully up to date by executing:

# yum update -y

then proceed with adding the EPEL repository to your CentOS 5 so you can install mod_evasive through yum:

# rpm -Uvh ftp://ftp.pbone.net/mirror/download.fedora.redhat.com/pub/fedora/epel/5/i386/epel-release-5-4.noarch.rpm

Once it is added, protect the base packages from EPEL:

# yum install yum-protectbase.noarch -y

Refresh the repositories using:

# yum update -y

and finally install mod_evasive by executing:

# yum install mod_evasive -y

Then, proceed with configuring Apache to use the mod_evasive module:

# echo -e "### LOAD EVASIVE ###\nLoadModule evasive20_module \
 modules/mod_evasive20.so\n###\n" > /etc/httpd/conf.d/mod_evasive.conf

# cat >> /etc/httpd/conf.d/mod_evasive.conf <
DOSHashTableSize 3097
DOSPageCount 5
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 60
DOSEmailNotify your@email.com
DOSLogDir /var/log/httpd/evasive

EOF

# chown apache: -R /var/log/httpd

# /etc/init.d/httpd restart

---

=> Installation on CentOS 6

Before installing mod_evasive on your CentOS 6 , make sure your operating system is fully up-to date by running:

# yum update -y

then proceed with adding the EPEL repository to your CentOS 6 so you can install mod_evasive through yum:

# rpm -Uvh ftp://ftp.pbone.net/mirror/download.fedora.redhat.com/pub/fedora/epel/6/i386/epel-release-6-8.noarch.rpm

Once it is added, protect the base packages from EPEL:

# yum install yum-plugin-protectbase.noarch -y

Refresh the repositories using:

# yum update -y

and finally install mod_evasive by executing:

# yum install mod_evasive -y

Then, proceed with configuring Apache to use the mod_evasive module:

# echo -e "### LOAD EVASIVE ###\nLoadModule evasive20_module \
 modules/mod_evasive20.so\n###\n" > /etc/httpd/conf.d/mod_evasive.conf

# cat >> /etc/httpd/conf.d/mod_evasive.conf <
DOSHashTableSize 3097
DOSPageCount 5
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 60
DOSEmailNotify your@email.com
DOSLogDir /var/log/httpd/evasive

EOF

# chown apache: -R /var/log/httpd

# /etc/init.d/httpd restart

Read More

LAMP (Linux, Apache, MySql & PHP) Installation and Configuration Centos

LAMP represents a full featured stack containing the most popular web server known as Apache, the most popular database server MySQL and the most popular open-source web programming language known as PHP.

This article shows how to setup LAMP on a Centos 6, The first thing we need to do is to make sure our system is fully up-to-date. So, executing the command below will install all available updates:

# yum update -y

After ‘yum’ finished updating your system, let’s proceed with the installation of Apache. Since it is available as a package in the official CentOS repositories the installation of Apache goes like this:

# yum install httpd -y

once the installation is completed add apache to your system’s startup:

# chkconfig --levels 235 httpd on

and finally start it up:

# service httpd start

Now, navigate to http://yourdomain.tld and you should see Apache’s default page in your browser.

The next step is to install PHP as an Apache module (mod_php) so you can run PHP scripts under your Apache web server. To do this execute:

# yum install php -y

after it is installed, create a PHP info page within Apache’s document root (/var/www/html) so you can verify if PHP support is enabled on your system.

# echo -e "" > /var/www/html/info.php

once the info.php file is created, reload apache so the newly installed PHP module can take effect.

# service httpd restart

Now open this test.php file in your browser (http://yourdomain.tld/info.php) and you should see various information about your PHP installation.

If you want to have additional PHP modules for example mysql support in your PHP, then you need to install the corresponding PHP module for MySQL. The package is named ‘php-mysql’ and can easily be installed using ‘yum’. The following is a list of the available PHP modules:

php-bcmath    =>  A module for PHP applications using the bcmath library
php-cli    =>  Command-line interface for PHP
php-common    =>  Common files for PHP
php-dba    =>  A database abstraction layer module for PHP applications
php-devel    =>  Files needed for building PHP extensions
php-embedded  =>  PHP library for embedding in applications
php-enchant    =>  Human Language and Character Encoding Support
php-gd     =>  A module for PHP applications using the gd graphics library
php-imap    =>  A module for PHP applications that use IMAP
php-intl    =>  Internationalization extension for PHP applications
php-ldap    =>  A module for PHP applications that use LDAP
php-mbstring        =>  A module for PHP applications which need multi-byte string handling
php-mysql    =>  A module for PHP applications that use MySQL databases
php-odbc    =>  A module for PHP applications that use ODBC databases
php-pdo    =>  A database access abstraction module for PHP applications
php-pear.noarch  =>  PHP Extension and Application Repository framework
php-pecl-apc   =>  APC cache optimizing PHP intermediate code
php-pecl-memcache  =>  Extension to work with the Memcached caching daemon
php-pgsql    =>  A PostgreSQL database module for PHP
php-process   =>  Modules for PHP scripts using system process interfaces
php-pspell    =>  A module for PHP applications using pspell interfaces
php-recode    =>  A module for PHP applications using the recode library
php-snmp    =>  A module for PHP applications that query SNMP-managed devices
php-soap    =>  A module for PHP applications that use the SOAP protocol
php-tidy    =>  Standard PHP module provides tidy library support
php-xml    =>  A module for PHP applications which use XML
php-xmlrpc    =>  A module for PHP applications which use the XML-RPC protocol
php-zts    =>  Thread-safe PHP interpreter for use with the Apache HTTP Server

so pickup the ones you need and install them using ‘yum’, for example:

# yum install php-cli php-common php-gd php-mysql -y

will install PHP command line interface, PHP’s common files and MySQL support for PHP. Do not forget to reload Apache so the new modules can take effect:

# service httpd restart

Next, we are going to install the MySQL server. This can be achieved by doing:

# yum install mysql mysql-server -y

after that add it to your system startup and start the MySQL server using the following commands:

# chkconfig --levels 235 mysqld on
# service mysqld start

Once it is started, it is recommended to set the MySQL ‘root’ password, disable remote ‘root’ login, remove anonymous users and remove the ‘test’ database. This can be easily accomplished by executing MySQL’s ‘mysql_secure_installation’ script. So execute:

# mysql_secure_installation

and just hit ‘ENTER’ when prompted.

With all that in place you have a working LAMP stack on your CentOS 6. A good idea is to install phpMyAdmin so you can easily manage your MySQL databases via a nice frontend written in PHP. So, proceed with installing phpMyAdmin using the following commands:

(at the time of writing this article the latest version of phpMyAdmin is 3.5.1. You can always go to http://sourceforge.net/projects/phpmyadmin/files/phpMyAdmin/ and install the latest version available)

# wget -P /tmp http://prdownloads.sourceforge.net/phpmyadmin/phpMyAdmin-3.5.1-english.tar.gz
# tar -zxf /tmp/phpMyAdmin*.tar.gz -C /var/www/html/
# mv /var/www/html/phpMyAdmin-3.5.1-english /var/www/html/dbAdmin
# cd /var/www/html/dbAdmin
# cp config.sample.inc.php config.inc.php

The last thing you should do is open phpMyAdmin’s configuration file:

# vim config.inc.php

and change the following line:

$cfg['Servers'][$i]['auth_type'] = 'cookie';

with

$cfg['Servers'][$i]['auth_type'] = 'http';

save the file and navigate to http://yourdomain.com/dbAdmin where you can login using your MySQL ‘root’ user and it’s password.

---

Before we finish with the setup it is recommended to install some PHP cache engine so it can do some caching and will certainly speed things up. So, install PHP APC cache by executing:

# yum install php-pecl-apc -y

The default APC settings are fine but configuring it to your needs is recommended if you want maximum performance. For a 512MB RAM based CentOS 6 the following APC configuration is optimal and is working perfectly fine. So edit/create ‘/etc/php.d/apc.ini’ containing the following options:

extension=apc.so
apc.enabled = 1
apc.shm_segments = 1
apc.shm_size = 32M
apc.optimization = 0
apc.num_files_hint = 512
apc.user_entries_hint = 1024
apc.ttl = 0
apc.user_ttl = 0
apc.gc_ttl = 600
apc.cache_by_default = 1
apc.filters = "apc\.php$"
apc.slam_defense = 0
apc.use_request_time = 1
apc.mmap_file_mask = /tmp/apc-CentOS.XXXXXX
;OR apc.mmap_file_mask = /dev/zero
apc.file_update_protection = 2
apc.enable_cli = 0
apc.max_file_size = 2M
apc.stat = 1
apc.write_lock = 1
apc.report_autofilter = 0
apc.include_once_override = 0
apc.rfc1867 = 0
apc.rfc1867_prefix = "upload_"
apc.rfc1867_name = "APC_UPLOAD_PROGRESS"
apc.rfc1867_freq = 0
apc.localcache = 1
apc.localcache.size = 512
apc.coredump_unmap = 0
apc.stat_ctime = 0

and finally reload Apache so the changes can take effect. Do that by executing:

# service httpd restart

For any  suggestions or feedback mail me .

Read More