April 2011
Intermediate to advanced
432 pages
11h 1m
English
book
CMS Security Handbook: The Comprehensive Guide for WordPress®, Joomla!®, Drupal™, and Plone®
by Tom Canavan
Content preview from CMS Security Handbook: The Comprehensive Guide for WordPress®, Joomla!®, Drupal™, and Plone®Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
Securing an Apache Server
One area that all people who interact with your CMS website will touch is your web server software. The Apache httpd web server is the most popular of the web servers on the market, with more than 50 percent of the market share.
Apache is a very well-maintained and developed system; generally it's secure out of the box. However, this robust system offers many different configuration options and, hence, many opportunities to leave something amiss.
Obviously, one of the first steps to securing an Apache server is to ensure that you use the latest version of Apache.
Log in to your server via SSH using Putty and issue the command httpd -v. A screen similar to that shown in Figure 5-7 should appear. Consult the Apache.org website to determine whether you need to update your version of Apache.
Figure 5-7: Apache version information
The rest of this section examines how to configure Apache for secure use and operation.
Configuring Apache for Secure Operation
An attacker who is more than a kiddie-scripter wants to gather as much information as possible. Given the likelihood you're running Apache, that part of the hacker's information gathering is out of the way. In that case, the next item the attacker wants to get is the version information about Apache, which means that you must restrict the information Apache gives out. Knowing your Apache version is a key source ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.