Data security is always a prerogative for each company. Thus, the specialists perform security testing very thoroughly. Software testing company applies various methodologies and techniques for ensuring the information integrity which is used by soft.
But the web server security is very important too. Only necessary information should be available, all data - secured, accesses - restricted. There are several ways to enhance the security level of the Apache server.
Apache Security may be improved by:
- removing the Apache version and information about the operating system
- denying the directory enumeration in the form of list
- stopping the work of the unnecessary modules
- restricting an access to the files beyond the root web directory
- using mod_evasive against the DoS attacks (denial of service)
- using mod_security
- limiting the request size.
For the Apache server, the error message contains the information about its version and OS name. These data may be used by hackers for attacks via public weak points of this specific version. In order to avoid this, one should change “server signature” in the configuration file. It is active by default.
If the root directory does not have an index file, then the Apache web server will display the whole directory content by default. This function may be also switched off in the Apache configuration file.
If the file access out of the web root directory is limited, then while attempting to receive some file from any other folder, an error message 404 will be given on the web server.
Conducting web application testing (compatibility checking, cross-browser testing, performance control, server side testing), the specialists thorough check all main system aspects.