Protecting web servers with ModSecurity

Apache Protector

Article from ADMIN 01/2010

By Sebastian Wolfgarten

Even securely configured and patched web servers can be compromised because of vulnerabilities in a web application. ModSecurity is an Apache extension that acts as a web application firewall to protect the web server against attacks.

Security issues on the web are no longer typically a result of poor configuration or the lack of up-to-date server software. Tomcat, Apache, and even IIS have become extremely mature over the past few years – so much so that they don't have any noticeable vulnerabilities, although exceptions can always turn up to prove the rule. Thus, hackers have turned their attention to the web applications and scripts running on the servers.

Increasingly complex user requirements are making web applications more complex, too: Ajax, interaction with external databases, back-end interfaces, and directory services are just part of the package for a modern application. And, attack vectors grow to match this development (see the "Attacks on Web Servers" box).

Attacks on Web Servers

Compared with local applications, web applications are more vulnerable because they involve so many different components – from the browser and the Internet infrastructure to the web server and the back ends beyond. Vulnerabilities can occur anywhere, but the server is always at the center of this environment.

If the web application doesn't sufficiently validate user input and instead passes it to a database running in the background, attackers could use SQL injection to inject their own commands into the command chain. Thus, the attacker would be able to read, modify, or delete data and thereby exert a major influence on the application.

If an application also allows attackers to store files on the web server and execute them over the web, the intruder could set up a web shell. Because the server will execute the attacker's files, the attacker can run operating system commands on the web server and finally escalate their privileges to interactive shell access. Although the architecture of a carefully configured Apache will not give the

...

Use Express-Checkout link below to read the full article (PDF).