Professional Apache Security (Programmer to Programmer)

Apache is the epitome of free software that is both the standard in a critical area (the Web), and widely accepted by proprietary software companies. With increased usage, server security becomes an issue of paramount importance.

Security is one of the most important factors that Apache administrators need to consider. Determining who is allowed access to what, verifying that people and systems are who they say they are, and eliminating security holes that could allow crackers to gain unauthorized access to a system are all issues that the conscientious web server administrator needs to worry about on a daily basis.

Apache provides many features that can be used to either compromise server security or gather information about a server that the administrator would prefer kept secret. Of course, these features aren't there to create security holes, but the more complex the configuration the more chances we have of creating an unanticipated use of the server. Understanding what is and what is not expected behavior is essential, both when creating the server configuration and detecting possible misuse.

There is no such thing as a totally one hundred percent secure server, but in this book we'll delve into crucial aspects of Apache security and practical ways to setting up a safer, more secure implementation of an Apache server.

Tony Mobily is a technical writer and technical editor who manages the Italian computer magazine "Login", and works daily with many Internet technologies. He is a senior system administrator and a security expert, and has lots of fun playing with buffer overflows, DOS attacks, and firewalls.

Paul Weinstein devotes his energies to developing and integrating web-based systems. He has become knowledgeable in the detail workings of many tools of the trade including, Apache, Perl, PHP, SSL, mySQL, and Linux. Currently, he works as Chief Consultant for Waubonsie Consulting, spending a good amount of his time communicating his past experience in technical articles and presentations to others.

Mark Wilcox is the senior integration specialist with WebCT, Inc. the leading provider of higher education e-learning solutions. His areas of expertise includes LDAP, authentication, security, and application integration.

Brian P. Rickabaugh is a senior systems architect for a global conglomerate in the financial, manufacturing and media industries. He is also president of StrayCat Incorporated, a small business focused primarily on software consulting services. He has been developing web-centric object-oriented software in C/C++ and Java for six years. He is also a huge proponent of open source software and the positive impact it can have on small, medium and large organizations. His current focus is on XML and implementing Web Services technologies for internal and external systems integration.

Debashish Bhattacharjee is a principal consultant with IBM Global Services. His areas of expertise are systems integration and project management. He has served as chief architect and led technical teams tasked with the implementation of e-commerce applications, portal implementations, web infrastructure, ERP, and client-server applications.

Sandip Bhattacharya is an open source enthusiast and an active participant in various open source communities in India, especially his local LUG at Delhi(ILUGD). He has been professionally involved in open source based technologies for the past three years. He is currently a freelance programmer and consults businesses on ways to use the open source revolution to their advantage.

Kapil Sharma is an Internet security and Unix consultant. He enjoys working on firewalls, Load Balancers, VPN, clustering, cryptography, white hat hacking, and various Unix flavours. He is actively involved in the open source community and has contributed many technical articles on system and network security.