Download Apache Benchmark for Unix - Secure Configuration Benchmarks

The Center for Internet Security
Apache Benchmark for Unix
gpg:
aka "[email protected]"
gpg:
aka "[email protected]"
gpg:
aka "William A. Rowe, Jr. <[email protected]>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:
There is no indication that the signature belongs to the owner.
Primary key fingerprint: 33 16 9B 46 FC 12 D4 01 CA 6D DB D7 DE EA 4F D7
Verify MD5 Checksum Description
MD5 is a one-way hash function, meaning that it takes a message and converts it into a fixed string of
digits, also called a message digest. In essence, MD5 is a way to verify data integrity, and is not a
reliable as a PGP signature as it doesn't authenticate, but it is much more reliable than a simple
checksum.
If you run MD5 against the Apache source you downloaded and the resulting hash number does not
match the MD5 check file, then you should download the entire distribution again. The following can
cause these mismatches: looking at wrong MD5 file, modified source code and errors in the downloading
process. The GNU Privacy Guard is the opensource implementation of PGP available on most
Unix/Linux platforms is available from <http://gnupg.org/> The md5 or md5sum programs are also
included in many Unix/Linux distributions. It is also available as part of GNU Textutils
<http://www.gnu.org/software/textutils/textutils.html>.
Action: Verify the MD5 Checksums
Execute the following commands to verify the MD5 checksum of the Apache source archive. The final
command piped to diff should have no output.
$ cat httpd-2.2.3.tar.gz.md5
f72ffb176e2dc7b322be16508c09f63c httpd-2.2.3.tar.gz
$ md5sum httpd-2.2.3.tar.gz
f72ffb176e2dc7b322be16508c09f63c httpd-2.2.3.tar.gz
$ md5sum httpd-2.2.3.tar.gz | diff httpd-2.2.3.tar.gz.md5 -
3. Configure the Apache Software
Description
Often times, web administrators compile/enable Apache modules which are unnecessary for the proper
functioning of their website. This is similar to the OS security issue of running unnecessary network
services; such as Telnet and FTP. By compiling and enabling these unused modules, you are potentially
providing additional avenues of attack against your web server. You should only enable the modules that
you absolutely need for the functionality of your web site. By removing certain modules, not only will you
increase security, but you will also increase the resulting speed of your Apache binary. If you are not
sure which modules you need, read about them at the following location –
<http://httpd.apache.org/docs/2.0/mod/>
Execute the following command to untar and view the configure default options for the Apache
compilation. In particular we are interested in enabling and disabling modules. for the resulting Apache
httpd binary:
$ cd some/build/directory/for/apache
$ tar xzf httpd-2.2.3.tar.gz
$ cd httpd-2.2.3
# ./configure –help
-- CUT -Optional Features:
--disable-FEATURE
do not include FEATURE
Version 1.6
Page 64 of 70