How to Secure Apache on Linux VPS

Securing Apache on a Linux VPS is essential to protect your data and web applications. In this article, we will explore the various steps and best practices to secure your Apache server.

Installing Apache

Before you can secure Apache, you first need to install it. Here’s how to do it on a Debian-based system:

sudo apt install apache2

Once the installation is complete, you can check that the Apache server is running correctly by accessing your IP address in a web browser.

Configuring the Firewall

A firewall is one of the first lines of defense to secure your server. Here are the steps to configure UFW (Uncomplicated Firewall) on Ubuntu:

sudo ufw allow 'Apache Full'
sudo ufw enable

These commands allow HTTP and HTTPS traffic on your server.

Checking Firewall Status

To check the status of your firewall, use the following command:

sudo ufw status

Configuring SSL with Let's Encrypt

To secure your exchanges, it is recommended to use SSL. Let's Encrypt offers a free way to obtain SSL certificates. Here’s how to proceed:

Installing Certbot

Install Certbot to obtain and manage your SSL certificates:

sudo apt install certbot python3-certbot-apache

Obtaining an SSL Certificate

Once Certbot is installed, run the following command to obtain an SSL certificate:

sudo certbot --apache

Follow the on-screen instructions to complete the process. Certbot will automatically configure Apache to use SSL.

Configuring File Permissions

File permissions play a crucial role in the security of your server. It is essential to restrict access to sensitive files.

File Permissions

Use the following commands to set appropriate permissions:

sudo chown -R www-data:www-data /var/www/html
sudo chmod -R 755 /var/www/html

Disabling Unused Modules

Apache comes with many modules that may not be necessary for your application. Disabling unused modules can reduce the attack surface.

List of Enabled Modules

To see the enabled modules, use:

apache2ctl -M

Disabling a Module

To disable a module, use the following command:

sudo a2dismod module_name

Configuring Security HTTP Headers

Security HTTP headers help protect your site from various attacks. Here are some headers you can add:

    Header set X-Content-Type-Options "nosniff"
    Header set X-XSS-Protection "1; mode=block"
    Header set X-Frame-Options "DENY"
    Header set Strict-Transport-Security "max-age=31536000; includeSubDomains"

Add these lines to your Apache configuration file, usually located at /etc/apache2/sites-available/000-default.conf.

Limiting Access to Specific IP Addresses

You can restrict access to your web server by allowing only certain IP addresses. For example, to allow access only to a specific IP address:

<Directory /var/www/html>
    Options Indexes FollowSymLinks
    AllowOverride None
    Require ip 192.168.1.1
</Directory>

Enabling Access Logging

Logging is essential for monitoring your server's activity. Ensure that logging is enabled in your Apache configuration file:

CustomLog ${APACHE_LOG_DIR}/access.log combined

Analyzing Logs

You can use GoAccess to analyze your access logs interactively. Install it with:

sudo apt install goaccess

Performing Regular Updates

Finally, it is crucial to keep your server up to date. Regularly run the following commands to update Apache and other packages:

sudo apt update
sudo apt upgrade

By applying these updates, you ensure that your server benefits from the latest security patches.

Conclusion

Securing your Apache server on a Linux VPS is an ongoing process. By following these steps and staying vigilant, you can effectively protect your data and web applications.