Securing Apache Win32 tips?

[freeOn]

Yeah I'm setting up a webserver as some of you know. It's Apache 1.3.23 for windows. Need to learn how to secure it from evil people. Just wondering if you guys knew of any tweaks that I could do for the Config file and other stuff that a newbie might need to know. I've got a book called Apache it's an O'Reilly book but it didn't go to far in depth for windows security

Sorry if this gets double posted

[souleman]

Best idea....Install it on *nix instead of windows.

[freeOn]

Souleman you know I can't use Linux or Unix on my computer... common now

[Gepeto]

Apache itself won't need to be secured (aside from normal updates) but you'll have to secure the windows box... set it up behind a firewall and allow only apache's port

[meister]

I use Apache myself, this are the things i made:

what about ssl ? http://www.webreview.com/1999/03_05...3_05_99_8.shtml
what about .htaccess ?
go to c:\apache\bin\
htpasswd -c c:\apache\htdocs\secrets\password.txt your user
make a .htaccess file (notepad):
AuthName Secrets
AuthType Basic
AuthUserFile htdocs\secrets\password.txt
AuthGroupFile dev\null
require user your user
open httpd.conf
search for AllowOverride
replace it through AuthConfig

if you now try to open the "secrets" directory or any file in it a Password form should pop up

this are only some suggestions. sure you can also set up some php or any other password dialog...

------------------------------------------------------------------------------------------------------------------------
"Knowledge is the Real Power"

[ac1dsp3ctrum]

Hmmm, freeOn.. Am I the 'evil' one?
PM me in IRC or in AO and ill give you a few tips

[freeOn]

hey Meister that link didn't work. Your not evil ac1dsp3ctrum I'm talking about the script kiddies who will erase all my files clear my database and other stuff.

Well I changed most of the defaults so there file names are different and changed the directory so nothing is where it should be. I thought that might help. Anyways more tips are welcome. Meister get back to me I'm curious to where that link goes. Ac1dsp3ctrum I'm goin to IRC right now.

[souleman]

Ahhh, not IRC. Watch out for that place. It is inheraently evil.

[Guus]

As a matter of fact, Acid, yes, you are - but for entirly other reasons Please post those tips here, I'm interested too.