文档介绍：Risk Advisory Services
Apache Security -
Improving the security of your web server by breaking into it
Sebastian Wolfgarten,
21C3, December 2004
sebastian.******@de.
1 Berlin, Germany -
Agenda
•Preface
• Introduction to Apache
• History of vulnerabilities
• Basic principles of Apache security
• Configuration analysis
• Advanced Apache security
• Demonstration
• Summary
• References
2 Risk Advisory Services Berlin, Germany -
Preface
$ whoami
• Student of business & computer science at the
University of Cooperative Education in
Stuttgart/Germany
• Working with Ernst & Young’s Risk Advisory Services
(RAS) group for more than 2 years
• Specialized work security, pen-testing and IT
forensics
• Author of more than a dozen articles for various
German IT magazines as well as three books (.
“Apache Webserver2”) for the Addison & Wesley
publishing house
• Reviewer for Addison & Wesley and O’Reilly US
3 Risk Advisory Services Berlin, Germany -
Introduction to Apache
There are many cowboys, but there is only one Apache
• Originally based on the NCSA written
by Rob McCool (University of Illinois) and for
the first time published in April 1995
• Powerful, modular, flexible, highly configurable,
extensible and freely available Open Source
web server
• Apache currently runs on approx. 68% of all
web servers worldwide making it the #1 choice
ever since 1996
4 Risk Advisory Services Berlin, Germany -
Introduction to Apache (cont.)
There are many cowboys, but there is only one Apache
• Currently three different version branches
(, and ) available whereas only
and are being actively developed
• is proven most stable but is feature-wise
frozen (only bug-fixing)
• introduces a bunch of cutting-edge features
including various runtime-models (MPMs),
multi protocol support, APR, IPv6, in-an