Security Notes

The number of websites on the internet that enforces SSL, ie: HTTPS version of their websites are growing day by day, which a good thing as far as security is concerned. This claim is not without any proof. All major web browser statistics published online does indicate this fact. Checkout the chrome staticstics on ssl published by Google, and Firefox statistics from Mozilla.

Apache and Nginx together contribute to at least 80 percent of the websites running on the entire internet. If you are a customer of a hosting service provider or a company, then also you are using Apache most of the time to run your website (because most of the hosting companies run cpanel Apache at the backend. Although, you cannot customize and configure Apache in such cases to your own wish ).

In this post we will be discussing actions and methods that need to be taken to secure your Apache web server to a certain extent. According to me you really cannot completely secure any server (primarily because each day some or the other vulnerabilities are discovered).  I remember the below line which I read somewhere…

 

“If you need your server to be really secure. Then do not connect it to a network”

 

Internet is a very beautiful place to learn new things and gain information. As it has to provide information and access to anybody from anywhere in the globe, there was no other option, than to keep it wide open to all public. Although in the beginning (during its infancy period)it was only used by good and nice fellows with good intention, gradually it has become a composite mixture of good and evil.

Virtual Private Network is a norm these days in any architecture, where you enable access to your internal network to authorized employees and other associates. In this tutorial we will be discussing the working and configuration of one such VPN solution.

Before getting inside the installation and configuration part we will discuss the basics of this technology. Wikipedia defines openvpn as follows.

A virtual private network (VPN) extends a private network across a public network, such as the Internet.

Actually I was writing a usual tutorial article for getting SSL VPN configured for clients to login using their key pairs. I was doing a little bit of research to make that article more accurate while I explain its working. And during that research I stumbled upon one interesting fact about the way we communicate using SSL. Hence this article is the result of whatever I found.

The main reason am writing this is because it has a major security impact on the way we communicate today over the internet.

During the mid 90's (1995 to be precise) one researcher named Tatu Ylönen, at the university of Helsinki (Finland) designed a protocol, that eventually replaced all remote login programs. The primary objective behind Tatu Ylönen's design of the new protocol was to stop password sniffing attacks.

In other words, remote login programs prior to 1995 used to send login credentials and other critical information in clear text format through the wire. Due to this, anybody with a little bit technical knowledge can sniff the packets and read the password.

The basic minimum security that any body can implement on a publicly exposed server is source address based or sometimes called as host based security. It is nothing but to allow your specified hosts or addresses to gain access, and block the rest.

An attacker can even compromise a source address based firewall by spoofing the source ip address (which will make the request appear to the server as one among your allowed source list )

But this situation becomes too difficult to implement if you wish to gain access to your publicly available server from anywhere in the world. The reason is you cant simply go ahead and do a “allow all addresses” to your remote login SSH port.

In this post i will explain some of the concepts related to DNS zone transfer, and how to secure zone transfer. As other tutorials i will begin with the basics and concepts, and then we will look into configuration part (i will include the configuration details in between.)

BIND is a highly used DNS server package available for both Linux and windows. It’s much flexible compared to other DNS server packages.

For those who don’t know what is a DNS zone file i will recommend reading the below article i wrote sometime back, which will explain the content of a zone file.

Read: What is a DNS zone file and its contents