Morgan's WebWorks "We make the web work for you!"

Apache Server and Security

This article was written for newbie's like me who need help with Apache on Linux FC4 computers. Apache is, without a doubt, the single most used internet server today. Apache is also known as ”Open Source Software". This doesn’t mean it is free necessarily, but it is free to optimize and if you can, improve the software. With Apache on Linux, it becomes very affordable to own your very own internet server. However, alone with wide use of Apache comes the need for security.

Authentication is any process by which you verify that someone is who they claim they are. This usually involves a username and a password, but can include any other method of demonstrating identity, such as a smart card, retina scan, voice recognition, or fingerprints.In my own exploration of Apache and its security I found it very easy to have access allowed to certain clients.

Let’s explore Apache...

For more information about Apache and commands used in the .htaccess file, visit the official Apache web site.

Part one of this series will show how to place security on a folder and limit access to that folder to a single name and have Apache prompt you for a user name and password. This is the most basic level of security you can establish but well worth the effort. There are more advanced techniques you can use for different levels of security. We will discuss more advanced levels as we accomplish each step.

As I began studying Apache’s security I realized a lot of the information I had learned didn’t make sense but started falling into place as I began using them. The first thing we need to do is create a folder we can use as a test folder. You need to have a general understanding of users on Linux. In this article we are going to use FD4 and we are going to create a user named ‘neo’ and a folder called ‘matrix’.

htaccess files must be uploaded as ASCII mode, not BINARY. You may need to CHMOD the htaccess file to 644 or (RW-R--R--). This makes the file usable by the server, but prevents it from being read by a browser, which can seriously compromise your security.