Red Hat ENTERPRISE LINUX 5 - VIRTUAL SERVER ADMINISTRATION, Руководство по развертыванию

Страница: 655 / 848

Securing the Apache HTTP Server
629
43.2.4.2. Beware of Syntax Errors
The NFS server determines which file systems to export and which hosts to export these directories to
by consulting the
/etc/exports
file. Be careful not to add extraneous spaces when editing this file.
For instance, the following line in the
/etc/exports
file shares the directory
/tmp/nfs/
to the host
bob.example.com
with read/write permissions.
/tmp/nfs/ bob.example.com(rw)
The following line in the
/etc/exports
file, on the other hand, shares the same directory to the host
bob.example.com
with read-only permissions and shares it to the
world
with read/write permissions
due to a single space character after the hostname.
/tmp/nfs/ bob.example.com (rw)
It is good practice to check any configured NFS shares by using the
showmount
command to verify
what is being shared:
showmount -e <hostname>
43.2.4.3. Do Not Use the
no_root_squash
Option
By default, NFS shares change the root user to the
nfsnobody
user, an unprivileged user account.
This changes the owner of all root-created files to
nfsnobody
, which prevents uploading of programs
with the setuid bit set.
If
no_root_squash
is used, remote root users are able to change any file on the shared file system
and leave applications infected by trojans for other users to inadvertently execute.
43.2.5. Securing the Apache HTTP Server
The Apache HTTP Server is one of the most stable and secure services that ships with Red Hat
Enterprise Linux. A large number of options and techniques are available to secure the Apache HTTP
Server — too numerous to delve into deeply here.
When configuring the Apache HTTP Server, it is important to read the documentation available for the
application. This includes
Chapter 22, Apache HTTP Server
, and the Stronghold manuals, available at
http://www.redhat.com/docs/manuals/stronghold/
.
System Administrators should be careful when using the following configuration options:
43.2.5.1.
FollowSymLinks
This directive is enabled by default, so be sure to use caution when creating symbolic links to the
document root of the Web server. For instance, it is a bad idea to provide a symbolic link to
/
.
43.2.5.2. The
Indexes
Directive
This directive is enabled by default, but may not be desirable. To prevent visitors from browsing files
on the server, remove this directive.