Re: [us...@httpd] Hardening Apache against attacks

2010-10-26 Thread Igor Galić
- "Jason Nunnelley" wrote: > > Why .htaccess? Security tip #1 should be 'disable .htaccess'. > Performance > > tip #1 too. > > I'm not running a vhost clients can control. I'm running a vhost for > production sites my dev team manages, and I don't always want my dev > team restarting Apache

Re: [us...@httpd] Hardening Apache against attacks

2010-10-26 Thread Jason Nunnelley
> Why .htaccess? Security tip #1 should be 'disable .htaccess'. Performance > tip #1 too. I'm not running a vhost clients can control. I'm running a vhost for production sites my dev team manages, and I don't always want my dev team restarting Apache to make changes. Also, .htaccess is in version

Re: [us...@httpd] Hardening Apache against attacks

2010-10-25 Thread Joost de Heer
On Sun, October 24, 2010 22:47, Jason Nunnelley wrote: > I've done a few things already: blocked certain IP blocks, block know > problematic user agents. I'm trying to collect a list of Apache and > site hardening (.htaccess) methods. Please share your favorite. Why .htaccess? Security tip #1 shou

Re: [us...@httpd] Hardening Apache against attacks

2010-10-25 Thread William A. Rowe Jr.
On 10/24/2010 3:47 PM, Jason Nunnelley wrote: > I've done a few things already: blocked certain IP blocks, block know > problematic user agents. I'm trying to collect a list of Apache and > site hardening (.htaccess) methods. Please share your favorite. Allowing .htaccess is orthogonal to hardenin

RE: [us...@httpd] Hardening Apache against attacks

2010-10-25 Thread Assarsson, Emil
Got an slowloris attack a while ago on my own server. I added a rule in iptables to limit numbers a single source IP could use. -- Emil -Original Message- From: Jason Nunnelley [mailto:ja...@jasonn.com] Sent: söndag den 24 oktober 2010 22:47 To: users@httpd.apache.org Subject: [us...@ht