How to secure Apache web server

Apache is a widely adopted open-source web server used for serving dynamic and static content. Because of its broad deployment across diverse environments, it is a frequent target for attackers seeking vulnerabilities to exploit. Properly configuring Apache and regularly auditing its security posture can help prevent data breaches, service disruptions, and unauthorized access.

Controlling the exposure of the server involves disabling unneeded modules, enforcing strict permissions, and limiting request methods. Enabling encryption with SSL or TLS ensures data in transit remains private, while tools like Fail2ban and ModSecurity help thwart malicious traffic. Additional measures like IP whitelisting and logging enhance oversight and security intelligence.

Ongoing maintenance is essential for defending against emerging threats. Regular updates, patches, and configuration reviews keep the environment resilient, while well-implemented firewalls and intrusion detection systems add further layers of defense. Combining these strategies forms a robust security model that protects sensitive data and supports continuous uptime.

1. Disable unnecessary modules.

   Use apachectl -M or httpd -M to list all currently enabled modules.

   sudo a2dismod autoindex
   sudo systemctl restart apache2
   
   Module autoindex disabled.

2. Set strict permissions for directories and files.

   Restrict file permissions to only allow access to the www-data or apache user. This ensures critical files are not accessible to unauthorized users.

   sudo chown -R www-data:www-data /var/www/html
   sudo find /var/www/html -type d -exec chmod 750 {} \;
   sudo find /var/www/html -type f -exec chmod 640 {} \;
   
   Permissions set to www-data for /var/www/html

3. Hide the Apache version and OS details in headers.

   Modify the Apache configuration file, usually apache2.conf or httpd.conf, to prevent exposure of sensitive details.

   ServerSignature Off
   ServerTokens Prod
   sudo systemctl restart apache2

4. Enforce HTTPS and disable HTTP.

   sudo a2enmod ssl
   sudo a2ensite default-ssl.conf
   sudo systemctl restart apache2
   
   Enabling site default-ssl.

   Use free tools like Let's Encrypt to obtain SSL certificates for encrypting traffic.

5. Configure a web application firewall (WAF) using ModSecurity.

   sudo apt-get install libapache2-mod-security2
   sudo systemctl restart apache2
   
   ModSecurity for Apache enabled.

   Use the default configuration for basic protection, and customize rules as necessary.

6. Limit HTTP request methods to only those required.

   <LimitExcept GET POST>
   Require all denied
   </LimitExcept>

7. Restrict server access using IP whitelisting.

   <Directory /var/www/admin>
   Order Deny,Allow
   Deny from all
   Allow from 192.168.1.100
   </Directory>
   sudo systemctl restart apache2

8. Enable logging and review logs regularly.

   sudo tail -f /var/log/apache2/access.log
   
   192.168.1.10 - - [13/Oct/2024:10:15:10 +0000] "GET /index.html HTTP/1.1" 200 345

   Use tools like Fail2ban to automate the banning of suspicious IPs based on log activity.

9. Set limits on request sizes and connection rates.

   LimitRequestBody 1048576
   DOSHashTableSize 3097
   DOSPageCount 2

10. Regularly apply updates and security patches.

    sudo apt-get update && sudo apt-get upgrade apache2

    Ensure that all Apache and module versions are regularly updated to include the latest security patches.