The most important steps to take to make an Apache server more secure

Run as an unprivileged user

In security, the principle of least privilege states that an entity should be given no more permission than necessary to accomplish its goals within a given system. In the context of your web server, this means locking down Apache to run only with the permissions necessary to run. A first step in this process is to configure Apache to run as an unprivileged system user (e.g., not root). This is done by setting the APACHE_RUN_USER and APACHE_RUN_GROUP variables in the /etc/apache2/envvars file:

Edit the file and change the following lines:

[user@instance]$ sudo vim /etc/apache2/envvars
# Since there is no sane way to get the parsed apache2 config in scripts, some
# settings are defined via environment variables and then used in apache2ctl,
# /etc/init.d/apache2, /etc/logrotate.d/apache2, etc.
export APACHE_RUN_USER=apache
export APACHE_RUN_GROUP=apache

Apache servers distributed as a common OS package may also use a user and group name such as www-data or nobody. Regardless of the choice of user’s name, make sure that the user/group selection has as few rights as necessary to run properly.

Disable .htaccess files

.htaccess files are a powerful feature that allow Apache to have its configuration extended outside its main config file. While this may be convenient, it does present a security risk, as Apache will read any .htaccess file in its path — even ones placed by an attacker that could compromise the server. It may be desirable to lock down the Apache configuration by disabling .htaccess files entirely. This can be done by editing the AllowOverride directive in the /etc/apache2/apache2.conf file:

[user@instance]$ sudo vim /etc/apache2/apache2.conf
AllowOverride None

Additionally, fine-grained control of which Apache directives can be used within .htaccess files can also be controlled by AllowOverride:

AllowOverride AuthConfig Indexes

In the example above, all directives that are neither in the group AuthConfig nor Indexes cause an internal server error. View the following site for further details:

• https://httpd.apache.org/docs/2.4/mod/core.html

Restrict access by IP

Sensitive areas of websites, such as admin control panels, should have strict access controls placed on them. Apache makes it easy to whitelist IP access to certain locations of your website and deny traffic to all other IP addresses. You can add the following to your /etc/apache2/apache2.conf file.

<Directory /PATH/TO/WEBDIR/wp-admin>
    # allow access from one IP and an additional IP range,
    # and block everything else
    Require ip 1.2.3.4
    Require ip 192.168.0.0/24
</Directory>

In this example, the use of the Require directive instructs Apache to allow access to the specified path if the requests come from any of the IP addresses listed, and to deny all other traffic.

Enable mod_reqtimeout

mod_reqtimeout is an Apache module designed to shut down connections from clients taking too long to send their request, such as is seen in a Slowloris attack. This module provides a directive that allows Apache to close the connection if it senses that the client is not sending data quickly enough. For example, add this to your /etc/apache2/apache2.conf file:

RequestReadTimeout header=10-20,MinRate=500 body=20,MinRate=500

In this example, Apache will close the connection if the client takes more than 10 seconds to send its HTTP headers, or if the client takes more than 20 seconds to send headers at a rate of 500 bytes per second.

Apache will also close the connection if the client takes more than 20 seconds to send its request body, but will allow the request to continue as long as the client sends more than 500 bytes per second.

This configuration allows clients with poor TCP connection quality (such as remote clients with high latency, or those on low-grade cellular or satellite networks) to send requests, while still protecting against known fingerprints of the Slowloris attack. RequestReadTimeout configurations can be complex, so it's recommended you review more information about this directive at the module documentation page.

Install a WAF

A WAF (web application firewall) is a piece of software designed to inspect HTTP/HTTPS traffic, deny malicious requests, and generally act as an additional layer of security in an HTTP web stack. A properly configured WAF can protect your site from SQLi, XSS, CSRF, and DDoS attacks, as well as provide brute force attack mitigation and zero-day threat patching. The most popular and stable WAF for Apache is ModSecurity. View the project’s GitHub page for more information on installation and configuration.

Automated Log Analysis + Monitoring

Programs like Fail2Ban can be used to monitor Apache access and error logs, searching for attack patterns and taking actions against the attacking client (such as dropping IP addresses, reporting malicious behavior to the IP’s owner, etc). Fail2Ban is extensible, allowing for the creation of unique search patterns and response behaviors. For more information and details on installation and configuration, see the project's GitHub page:

• fail2ban GitHub project page

Limit input traffic via IPTables

Beyond securing Apache itself, it’s important to secure the host environment used to host the web server. Locking down access to things like SSH can greatly increase the security of the host by preventing intrusion attempts. A common approach is to whitelist known IPs that will access the host via SSH and deny all other port 22 traffic, or to use a jump box that strictly filters shell access. You can also do this by configuring a custom security group for your instance. View the following article for more information:

• Configuring security groups