Now that you know your installation works, make it more secure. Being brave, we start with an empty configuration file, and work our way up to a fully functional configuration. Starting with an empty configuration file is a good practice since it increases your understanding of how Apache works. Furthermore, the default configuration file is large, containing the directives for everything, including the modules you will never use. It is best to keep the configuration files nice, short, and tidy.
Start the configuration file (/usr/local/apache/conf/httpd.conf) with a few general-purpose directives:
# location of the web server files ServerRoot /usr/local/apache # location of the web server tree DocumentRoot /var/www/htdocs # path to the process ID (PID) file, which # stores the PID of the main Apache process PidFile /var/www/logs/httpd.pid # which port to listen at Listen 80 # do not resolve client IP addresses to names HostNameLookups Off
Setting Up the Server User Account
Upon installation, Apache runs as a user nobody. While this is convenient (this account normally exists on all Unix operating systems), it is a good idea to create a separate account for each different task. The idea behind this is that if attackers break into the server through the web server, they will get the privileges of the web server. The intruders will have the same priveleges as in the user account. By having a separate account for the web server, we ensure the attackers do not get anything else free.
The most commonly used username for this account is httpd, and some people use apache. We will use the former. Your operating system may come pre-configured with an account for this purpose. If you like the name, use it; otherwise, delete it from the system (e.g., using the userdel tool) to avoid confusion later. To create a new account, execute the following two commands while running as root.
These commands create a group and a user account, assigning the account the home directory /dev/null and the shell /sbin/nologin (effectively disabling login for the account). Add the following two lines to the Apache configuration file httpd.conf:
User httpd Group httpd
Please check back next week for the continuation of this article.
