Interview with Scott Hawkins, author or "Essential Apache for Web Professionals"
by Mirko Zorz - Tuesday, 15 April 2003.
Running on Apache (as opposed to IIS) is a good first step :^). In all seriousness, it's not possible to put together a security policy that is exactly right for every environment. The below is a short list of things that are always a good idea:
  • a. Don't run as root
  • b. Create directories for any CGI content and allow CGI to be run ONLY from those locations.
  • c. Disable telnet and ftp services on your machine and replace with ssh/scp.
  • d. Disallow the use of .htaccess files by using the "AllowOverride None" directive.
  • e. Make sure someone in your organization is responsible for keeping an eye on security advisories, and upgrading as necessary.
What version of Apache do you prefer, 1.3.x or 2.0.x?

As a programmer, I prefer 2.0. As the name implies, Apache 1.x was in fact fairly patchy. I think 2.0 is an elegant consolidation of the core features, and very well thought-out with regards to future requirements--for instance, they've put some real effort into wireless support. I'm also excited about the multithreading refinements, and what that means for the Apache vs. IIS duel.

However, in my day-to-day life I'm still using 1.3. I wouldn't call it a preference, but my business relies on a number of modules that are only available for 1.3.

What are your future plans? Any exciting new projects?

As it happens, yes. I'm just wrapping up a year-long development effort this week. Myself and a few partners have created a GUI interface to Unix that can be run on the wireless handheld devices. The idea is to give all the pager slaves out there a way to fix Unix problems without staying chained to a terminal.

Spotlight

Windows 0-day exploited in ongoing attacks, temporary workarounds offered

Posted on 22 October 2014.  |  A new Windows zero-day vulnerability is being actively exploited in the wild and is primarily a risk to users on servers and workstations that open documents with embedded OLE objects.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Thu, Oct 23rd
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //