Interview with Scott Hawkins, author or "Essential Apache for Web Professionals"
by Mirko Zorz - Tuesday, 15 April 2003.
Running on Apache (as opposed to IIS) is a good first step :^). In all seriousness, it's not possible to put together a security policy that is exactly right for every environment. The below is a short list of things that are always a good idea:
  • a. Don't run as root
  • b. Create directories for any CGI content and allow CGI to be run ONLY from those locations.
  • c. Disable telnet and ftp services on your machine and replace with ssh/scp.
  • d. Disallow the use of .htaccess files by using the "AllowOverride None" directive.
  • e. Make sure someone in your organization is responsible for keeping an eye on security advisories, and upgrading as necessary.
What version of Apache do you prefer, 1.3.x or 2.0.x?

As a programmer, I prefer 2.0. As the name implies, Apache 1.x was in fact fairly patchy. I think 2.0 is an elegant consolidation of the core features, and very well thought-out with regards to future requirements--for instance, they've put some real effort into wireless support. I'm also excited about the multithreading refinements, and what that means for the Apache vs. IIS duel.

However, in my day-to-day life I'm still using 1.3. I wouldn't call it a preference, but my business relies on a number of modules that are only available for 1.3.

What are your future plans? Any exciting new projects?

As it happens, yes. I'm just wrapping up a year-long development effort this week. Myself and a few partners have created a GUI interface to Unix that can be run on the wireless handheld devices. The idea is to give all the pager slaves out there a way to fix Unix problems without staying chained to a terminal.


Critical bug found in Cisco ASA products, attackers are scanning for affected devices

Several Cisco ASA products - appliances, firewalls, switches, routers, and security modules - have been found sporting a flaw that can ultimately lead to remote code execution by attackers.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Fri, Feb 12th