Security is a major concern in today’s world. Hackers will take every possible opportunity to deface your website and exploit the system. Ensuring the security for a website or web application should be done in both ways – securing the web application as well as securing the web server. Today we shall discuss how you can tweak some security options on your LAMP Stack.

Whenever a web server serves the responses to web browsers (or other clients), the server provides some “header information”. By default Apache (the “A” in LAMP) web server publishes much details about the environment. PHP also exposes itself sometimes in the headers. An expert hacker shall take advantage of the information collected from these headers. If you know the operating system, the web server, version of scripting engine and other minor but important bits of a hosting environment, it becomes quite easy for an attacker to find specific bugs or security flaws in those technologies and exploit them. You should always upgrade your available technologies but most importantly you should never let these sensitive information leak out in the wild. Luckily we can configure both Apache and PHP to remain silent while keeping the potential abusers in the dark.

These configuration requires administrative privileges on the system. The tutorial covers Ubuntu Linux and assumes that you have the required level of permissions to make these changes.

Configuring Apache

In case something bad happens, we should first back up the default apache configuration file so that we can always restore. Use this command to back it up:

sudo cp /etc/apache2/apache2.conf /etc/apache2/apache2.conf.bak

Now, let’s edit the configuration file:

sudo nano /etc/apache2/apache2.conf

Nano is a very smart and powerful text editor on the terminal. If you (unfortunately enough) don’t have nano installed, you can install it by typing:

sudo apt-get install nano

If you have nano (I hope you have) already, skip this step. You should now see the configuration file open in the terminal:
Press the down arrow to scroll down to the section that reads “ServerTokens Full”. This portion asks the apache to send full information in the headers. That is not what we want. If you look at the text, you can see the available options. We shall go for “Prod” which emits the least information. So, let’s change it so that it now reads “ServerTokens Prod”. Now, scroll down a bit more and find the “ServerSignature On” and change it to “ServerSignature Off”. Now press Ctrl + O to save the changes and then Ctrl + X to exit.

Configuring PHP

Now, we need to do the same thing for PHP. First, back up the original PHP configuration file:

sudo cp /etc/php5/apache2/php.ini /etc/php5/apache2/php.ini.bak

Open the configuration file:

sudo nano /etc/php5/apache2/php.ini

Change “expose_php = On” to “expose_php = Off”. Like before, press Ctrl + O to save the changes and then Ctrl + X to exit.
After configuring PHP and Apache, we need to restart the web server so that the changes take affect. Remember, this is very important. The settings will not be active until you reload the server.

sudo /etc/init.d/apache2 restart

In the coming posts, I shall try to focus on the different aspects of web application securities.

FTP is the best way to transfer (read upload) files to the web servers from our PC. FTP stands for File
Transfer Protocol. It’s very unlikely that you haven’t heard about FTP servers yet. In case you really
haven’t, FTP on Wikipedia.

If you are using a shared host, you probably already have FTP server installed and
ready for access. But if you are using a dedicated server, you shall have to install FTP server
and configure it yourself before you can start uploading files using a FTP client like Filezilla. In this
post, we are going to see how we can easily install a FTP server on a Ubuntu machine.

We shall use the “vsftpd” server as it is very easy to setup and configure. Use the following command to
install it on a Ubuntu machine:

sudo apt-get install vsftpd

Like most other services on a Ubuntu machine, the configuration data is stored in “/etc/vsftpd.conf” file.
Before we start the service, let’s modify the configuration file to customize the server behaviour a bit.

Before editing the file, please make a backup of the original content. Use the following command:

sudo cp /etc/vsftpd.conf /etc/vsftpd_conf_orig.bkp

Now let’s edit the file and make the changes. To edit the file, we shall use the nano text editor:

sudo nano /etc/vsftpd.conf

Please note that nano is the most user friendly text editor on the terminal. If you don’t have it, please
use this command to install it first:

sudo apt-get install nano

Here’s a sample of custom configuration you might want to use:

listen=YES
anonymous_enable=YES
write_enable=YES
local_umask=022
anon_upload_enable=YES
anon_mkdir_write_enable=YES
xferlog_enable=YES
chown_uploads=YES
chown_username=masnun
ftpd_banner=Welcome to the FTP service.
chroot_local_user=NO
secure_chroot_dir=/var/run/vsftpd
pam_service_name=vsftpd

Leave the other options unchanged. After the configuration is done, let’s start the server:

sudo /etc/init.d/vsftpd start

You can stop it with this command:

sudo /etc/init.d/vsftpd stop

And restart using:

sudo /etc/init.d/vsftpd restart

PHP, Perl, Python and Ruby on Rails are all WEB PROGRAMMING LANGUAGES also known as scripting languages.

PHP is the most commonly used and available for web hosting, followed by Perl (which is what is used most of the time when you see the phrase CGI or cgi-bin).

Which language is used to code web software doesn’t really matter, as long as your web host supports the language. In addition to PHP and Perl, many hosts are starting to offer support for Python and Ruby on Rails.

From a security standpoint, poorly coded can potentially be a nightmare for any server admin or website owner. There are many security flaws in PHP that a hacker can exploit, and those are only worsened when a PHP script is written badly.

There are several very important things you should always remember when experimenting with web software.

First of all, you should only use web software if you’ve read a lot about it and found out other people’s opinions of the software.

Anytime you upload or install software to your hosting account, you’re giving the program free reign to do just about anything within your web space or possibly even the whole server. You should only install trusted software.

Second, you should always make sure that all your web software is kept as up to date as possible. The more time that passes after a software is released, the more time a hacker or some other malicious person has to examine the code and find a way to exploit it.

Third, no matter how much you trust the software and keep it up to date, it still may run inefficiently. If it frequently uses up too much of the servers resources, your hosting provider may suspend your account or at least ask you to remove the software.

Finally, in case something bad happens, you should always remember to take complete backups of your account on a regular basis. For advice on backups, watch the tutorial later on in this series.

PHP, PERL, PYTHON AND RUBY ON RAILS

SHARED HOSTING is probably what you’re most interested in, especially if you’re just starting out in web hosting. With shared hosting, you’ll be on a server with potentially hundreds of other accounts. This is the cheapest form of hosting, for the hosting provider and for you.

If your account frequently uses up a lot of server resources your hosting provider will probably ask you to upgrade to something more suited to your website’s needs.

One option is another type of “shared’ hosting called RESELLER HOSTING. This basically allows you to sell shared hosting accounts to other people. Sometimes a reseller server will be less crowded and better suited to websites with high resource usage.

Another option is a DEDICATED SERVER. This is the most expensive form of web hosting and will cost you at the very least $40 a month, but probably closer to $100. Since you probably won’t know how to manage the server yourself, it would probably cost closer to $200 per month, total, for an entry level managed server.

A MANAGED DEDICATED SERVER leaves the hardest parts of operating a server to experienced technicians, letting you focus on the website side of things.

On a slightly smaller scale, the VIRTUAL DEDICATED SERVER also known as VIRTUAL PRIVATE SERVER and commonly shortened to VDS and VPS, respectively. What hosting companies do is divide a very powerful dedicated server up into separate “virtual” servers, using virtualization software. Each virtual server gets its own operating system, and acts almost exactly like a real dedicated server.

Depending on the hosting provider and the plan you choose, VDS’s may not be anywhere near as powerful as a real dedicated server.

It takes just as much work to manage a VDS as it does an actual dedicated server, though, so really the only benefit is decreased cost. A VDS can typically be purchased for anywhere from $10 monthly up to the price of a small dedicated server.

These are the most common types of web hosting. There are a few others, including cloud hosting, clustered hosting and grid hosting but we wont go into those here.

Different types of hosting accounts

EMAIL FORWARDERS allow you to forward a copy of all mail from one address to another. For example, you could set up a forwarder to forward all mail received on info@mysite.com to admin@mysite.com.

The address info@mysite.com will still keep the original version of all messages it receives, and admin@mysite.com gets forwarded a copy.

It’s worth noting that this relationship doesn’t work in two directions. Mail received by admin will not go to info.

Another type of forwarding is a domain forwarder. This will forward all mail received on a specific domain to another domain. If we forward mysite.com to demosite.com, admin@mysite.com and info@mysite.com would be forwarded to admin@demosite.com and info@demostie.com, respectively.

The last kind of forwarder mentioned is a catch-all or default email address. With this kind of forwarder, mail sent to an email address that doesn’t’ exist will be forwarded to the email address you specify.

What are email forwarders?

WEB SERVERS are computers that have been set up by a hosting company, usually in a facility called a datacenter. A web server’s sole purpose is to store websites until someone wants to visit them, and then to quickly respond to the visitor’s browser with the site’s content.

A server should be able to respond to at least several dozen, if not hundreds of requests at a time. How many websites a server can comfortably host depends on a wide variety of factors including server hardware and how popular the websites are.

Even the most expensive server hardware isnt’ going to be very useful without the software to actually get things done. The key software programs of a web server are also themselves called servers, or daemons.

Most servers used for web hosting have at least these kinds of software servers running at all times:

• An HTTP or web server (to provide the website)
• An FTP server (for uploading files)
• And E-MAIL server or two
• A DATABASE server (for storing information essential to the operation of a website)

You might be wondering: are web servers even necessary? Why can’t I just run my websites from a computer at home? There are several reasons why web servers are necessary.

Most ISPs (Internet Service Providers) specifically disallow people from running any type of web-related server on their networks. Doing so can potentially get your internet account suspended or terminated.

But, even if that weren’t the case, you have to take into account the upload speed of your connection. While broadband connections are getting faster and faster, upload speeds are usually about 10-20 times slower than download speeds.

When running a server on your computer, your upload speed would directly determine the total download speed shared across everyone accessing your sites. Most likely you’ll only be able to offer up a megabit or two, and even if you’re just hosting a website with pictures on it, that will quickly be used up by only a few people.

A professional server with a hosting provider, on the other hand, could have a connection as fast as 10,000 megabits. YOU’D HAVE TO PAY A FORTUNE TO GET EVEN A 100 Mbit connection to your house. Whereas a hosting provider can offer you space on a server with an ultra-high speed connection for a fraction of the cost!

Moreover, most consumer broadband ISPs aren’t’ reliable enough to host a website. You’ll probably want people to be able to visit your site at all hours of the day, and that won’t be possible if your internet connection is acting up or your ISP is performing maintenance.

What are webservers and are they necessary

Domain names can be purchased at any accredited domain registrar. A domain registrar is a company whose main purpose is to register domain names for people.

Most hosting providers can also obtain a domain name for you, but domains can be more expensive this way, due to the added overhead.

There are several very popular domain registrars including GoDaddy.com, Enom.com and Dotster.com. Most of their prices should be about the same.

All three of the above listed sites do, of course, have a way for you to check if a domain name is available for purchase. This tutorial uses GoDaddy.com as an example.

On the main page, you’ll see START A DOMAIN NAME SEARCH. In the box provided, enter the domain name you’re interested in, then select the desired extension (for example: .com) and click GO.

The next screen will indicate whether or not the domain name you’ve chosen is available. If the name is unavailable, a list of suggestions will also appear.

Purchasing a domain name

A PARKED DOMAIN is a domain name that leads to the same website as another domain name. the domain is, in essence, parked on top of another domain.

For example, suppose we have a domain name mysite.com. if we park mysite.org on top of the .com domain, a visitor to our site will be able to access the site from either the .com or .org address. The visitor won’t notice any difference in the website at all no matter which one he chooses.

An ADD-ON DOMAIN, on the other hand, is a domain that will display a completely different website. So if you pay to be able to host an add-on domain on your hosting account, you are basically being given permission to host another site in addition to your main website.

It is important to note that buying add-on domain or parked domain rights from your hosting provider doesn’t actually give you a domain name; it just gives you the ability to add that domain to your account. You’ll still have to pay the domain name, too.

SUB-DOMAINS, though, will work off your existing domain names. They can be sued for the same purpose as regular domain names; they just have an extra part in front.

WWW is actually considered a sub-domain, but one that is usually parked on top of the main domain.

Another example could be if you created two sub-domains dogs and cats on mypetsite.com. You’d visit those sub-domains in your browser using http://cats.mypetsite.com and http://dogs.mypetsite.com respectively.

You could set each sub-domain to go to its own website, or go to a secure section of the main mypetsite.com site.

Parked, Add-on and Sub-Domains

Every server in the world that has access to the internet has at least one IP ADDRESS—to a computer, this is like a phone number. An example of an IP Address is 741.125.45.100.

Instead of having to remember a bunch of numbers, domain names allow us to assign a name to those numbers. Without domain names, you would have to enter an IP address every time you wanted to visit a website. Isn’t google.com much easier to remember than 74.125.45.100?

Domain names contain letters, numbers and hyphens. They can be hundreds of characters in length, but the shorter the domain the better.

In order for your computer to figure out what IP address to use for a domain name, it has to connect to a nameserver also called a DNS Server. That server connects to another server, which connects to another, and so on, until a server is encountered that knows the right IP address for the domain name.

When you purchase a domain name, you tell the domain registrar that all requests for an IP address for that domain name should be directed toward your hosting providers nameservers.

Once you’ve informed your web host of the domain you plan to use, they’ll configure their nameservers to give your domain name a specific IP address.

Usually, you’ll share an IP address with many other domain names. You can also purchase a dedicated IP address from your web host, and that will be yours alone to use. Whichever the case, the important thing is that you have an IP address assigned to your domain, and that all the right nameservers know what it is.

Domain names and how they work

BACKUPS are crucial to the smooth operation of any website, no matter how important, how many visitors you have, or how frequently the site content changes.

The FREQUENCY at which you should take backups does depend on those factors, as well as exactly what kind of sites and software you have on your account.

If you have any web software installed that depends on a database to function, then you should take backups of all your databases at least once a day. The databases are usually the most frequently changing part of your hosting account. Some web software programs have a backup system built in.

If the files on your hosting account are likely to change often, you should also back them up every day. Otherwise, once a week or once a month, even once every few months should be sufficient. Just make sure you keep the backups in a safe place, preferably on some sort of disk like a CD or DVD or external hard drive.

Even though you may think nothing is going to happen to your information, you shouldn’t assume that everything will be ok. Hard drivers fail more frequently than most people think.

Almost every control panel has some sort of backup system in place. Some will let you set up automatic backups and most will allow you to take a backup manually. IF THERE IS NO SORT OF BACKUP MECHANISM YOU CAN ALWAYS TAKE A BACKUP MANUALLY VIA FTP.

Many web hosts will take frequent backups of all the accounts on their servers, but you shouldn’t count on that. The more backups you or anyone else takes of your account, the less likely you are to lose important data.

Backing up accounts, how often