Guidelines on Securing Public Web Servers

7.6 W

EB 

A

UTHENTICATION AND 

E

NCRYPTION 

T

ECHNOLOGIES 

C

HECKLIST

.....................62 

8.  IMPLEMENTING A SECURE NETWORK FOR A WEB SERVER...........................64 

8.1 N

ETWORK 

L

OCATION

.................................................................................................64 

8.2 N

ETWORK 

E

LEMENT 

C

ONFIGURATION

.......................................................................69 

8.3 N

ETWORK 

I

NFRASTRUCTURE 

C

HECKLIST

...................................................................76 

9.  ADMINISTERING A WEB SERVER............................................................................78 

9.1 L

OGGING

....................................................................................................................78 

9.2 W

EB 

S

ERVER 

B

ACKUP 

P

ROCEDURES

..........................................................................82 

9.3 R

ECOVERING 

F

ROM A 

S

ECURITY 

C

OMPROMISE

..........................................................85 

9.4 S

ECURITY 

T

ESTING 

W

EB 

S

ERVERS

.............................................................................87 

9.5 R

EMOTELY 

A

DMINISTERING A 

W

EB 

S

ERVER

..............................................................90 

9.6 S

ECURELY 

A

DMINISTERING A 

W

EB 

S

ERVER 

C

HECKLIST

............................................91 

APPENDIX A. SECURING APACHE WEB SERVER......................................................A 1 

A.1 I

NSTALLATION

..........................................................................................................A 1 

A.2 I

NITIAL 

C

ONFIGURATION

..........................................................................................A 4 

A.3 P

ATCHING 

A

PACHE

.................................................................................................A 10 

A.4 M

AINTAINING A 

S

ECURE 

A

PACHE 

C

ONFIGURATION

...............................................A 10 

APPENDIX B. SECURING INTERNET INFORMATION SERVER ...............................B 1 

B.1 IIS 

O

VERVIEW

..........................................................................................................B 2 

B.2 IIS 

O

VERVIEW

..........................................................................................................B 2 

B.3 W

HERE TO 

I

NSTALL 

IIS ............................................................................................B 4 

B.4 C

ONFIGURING 

W

INDOWS 

O

PERATING 

S

YSTEM

.........................................................B 4 

B.5 C

ONFIGURING 

IIS .....................................................................................................B 9 

B.6 C

ONFIGURING 

A

CTIVE 

S

ERVER 

P

AGES

...................................................................B 17 

B.7 P

ATCHING 

IIS .........................................................................................................B 18 

B.8 M

AINTAINING 

S

ECURE 

IIS C

ONFIGURATION

..........................................................B 19 

B.9 M

ICROSOFT 

P

ATCHING 

T

OOLS

................................................................................B 20 

B.10 M

ICROSOFT 

W

INDOWS 

S

ECURITY 

C

HECKLIST

: ...................................................B 36 

B.11 M

ICROSOFT 

I

NTERNET 

I

NFORMATION 

S

ERVER 

S

ECURITY 

C

HECKLIST

.................B 37 

APPENDIX C. ONLINE WEB SERVER SECURITY RESOURCES ...............................C 1 

APPENDIX D. GLOSSARY ................................................................................................D 1 

APPENDIX E. WEB SECURITY TOOLS AND APPLICATIONS ...................................E 1 

APPENDIX F. REFERENCES............................................................................................. F 1 

APPENDIX G. PRINT RESOURCES..................................................................................G 1 

APPENDIX H. WEB SERVER SECURITY CHECKLIST ................................................H 1 

I

NSTALLING AND 

C

ONFIGURING THE 

W

EB 

S

ERVER 

S

ECURELY

...........................................H 2 

S

ECURING 

W

EB 

C

ONTENT

...................................................................................................H 3 

E

MPLOYING 

W

EB 

A

UTHENTICATION AND 

E

NCRYPTION 

T

ECHNOLOGIES

............................H 5 

vi