Using Mod_Security to Protect Your Server - Application Server Hardening
(Page 4 of 4 )
Like web servers, application servers are flexible in their configuration. This flexibility allows them to be integrated into diverse environments. However, in many cases the out-of-the-box installation will not be hardened for Internet usage. Steps need to be taken to configure these servers so that they are secure. The following are some hardening guidelines for application servers.
Java and .NET
The following are hardening recommendations for all next generation web application servers, but particularly for Java and .NET servers.
Hardening guidelines
Run all applications over SSL.
Do no rely on client-side validation. Make input validation decisions on the server.
Use the HttpOnly cookie option to help protect against cross-site scripting.
Plan how authentication and access controls work before implementation.
Employ role-base authorization checks for resources such as pages and directories.
Divide the file structure of the site into public and restricted areas and provide proper authentication and access controls to restricted areas.
Validate all input for type, length, and format. Employ positive validation and check for known acceptable data before filtering for bad data.
Handle exceptions securely by not providing debug or infrastructure details as part of the exception.
Use absolute URLs when sites contain secure and unsecure items.
Ensure parameters used in SQL statements or data access codes are validated for length and type of data to help prevent SQL injection.
Mark cookies as “secure.” Restrict authentication cookies by requiring the use of the secure cookie property.
Ensure authentication cookies are not persisted or logged.
Make sure cookies have unique path/name combinations.
Personalization cookies are separate from authentication cookies.
Require error-directives or error pages for all web applications.
Strong password policies are implemented for authentication.
Define a low session timeout (15 minutes).
Avoid generic server resource mappings such as wildcards (/*.do).
Protect resources by storing them under the WEB-INF directory and not allowing direct access to them.
Do not store sensitive data (passwords, private data, and so on) in a web application root directory or other browsable location.
For More Information
Apache. “Apache HTTP Server Project.” http://httpd.apache.org/.
CERT. “Creating a Computer Security Incident Response Team: A Process for Getting Started.” http://www.cert.org/csirts/Creating-A-CSIRT.html.
Howtoforge. “Secure Your Apache with mod_security.” http://www.howtoforge.com/apache_mod_security.
Microsoft. Technical Overview of Internet Information Services (IIS) 6.0. http:// download.microsoft.com/download/8/a/7/8a700c68-d1af-4c8d-b11e-5f974636a7dc/ IISOverview.doc (accessed Dec. 1, 2006).
“Checklist: Securing Your Web Server.”, http://msdn2.microsoft.com/en-us/library/ aa302351.aspx.
Microsoft., “Checklist: Securing ASP.NET.”; available from: http://msdn2.microsoft.com/ en-us/library/ms178699.aspx.
O’Reilly ONLamp.com. LAMP: The Open Source Platform. http://www.onlamp.com.
PHP. “Hypertext Preprocessor.” http://www.php.net/.
Ristic, Ivan. Apache Security. California: O’Reilly Media, Inc., 2005.
Security Focus. “Incident Response Tools For Unix, Part One: System Tools.” http:// www.securityfocus.com/infocus/1679.
Ubuntu. “What Is Ubuntu?” http://www.ubuntu.com/.
| DISCLAIMER: The content provided in this article is not warranted or guaranteed by Developer Shed, Inc. The content provided is intended for entertainment and/or educational purposes in order to introduce to the reader key ideas, concepts, and/or product reviews. As such it is incumbent upon the reader to employ real-world tactics for security and implementation of best practices. We are not liable for any negative consequences that may result from implementing any information covered in our articles or tutorials. If this is a hardware review, it is not recommended to open and/or modify your hardware. |
|
 This article is excerpted from chapter four of Securing Ajax Applications: Ensuring the Safety of the Dynamic Web, written by Christopher Wells (O'Reilly, 2007; ISBN: 0596529317). Check it out today at your favorite bookstore. Buy this book now.
|
|
