. Great book, useful for all Apache users, November 3, 2005 Reviewer: Anton Chuvakin (NJ, USA) See all my reviews I thoroughly enjoyed Ivan`s Apache Security , even when I was a reviewer for an unfinished book. I remember how I was eagerly waiting to receive more new chapters from the publisher. The book contains a nice combination of generic web stuff and Apache stuff. It starts with the discussion of security principles, such as defenseindepth and minimum access privilege. Although not new, they are useful for those just entering the field, such as for beginner apache admins. The chapter on Apache`s installation and configuration sounds boring and many might be tempted to skip it. But it does contain a gem: a guide on setting Apache in a chroot jail! PHP, a main web application platform for Apache at the time of this writing, is covered as well. I found some tips on PHP hardening that I didn`t know previously. While the last PHP application I deployed was configured to be `hackable` (it was a honeypot deployment, after all!), I found the tips to be practical. One entertaining chapter is on denialofservice attacks. There are many ways to overwhelm a network server, and Apache is now exception. It`s a mustread for those running highlyavailable sites, where downtime costs a lot. An important chapter covers Apache access control, from basic auth to single signon. Of course, of particular interest to me was a chapter on logging and monitoring, as it is one of my favorite subjects. Ivan did a great job covering not only logging facilities available within the server, but also log centralization, log analysis for security, integrity monitoring and other stuff. Distributed logging with Spread kit is indeed `cool`, just as Ivan mentions. A brief chapter covers the security of the underlying `infrastructure`, such as the OS that Apache runs on. I liked the overview since it is not `generic`, but covers material relevant to running Apache web server. Chapter 1012 are at the center of the book, providing the core of the new material. Those cover web application attacks, web security assessment and web intrusion detection,. The latter is based on Ivan`s famous mod_security Apache module. While web attacks are covered in many places, I think the overview in the book is clear, focused and useful even for those who do web security for a living. As far as the mod_security chapter is concerned, I would read it with most care since it covers a lot of advanced usage tips, not available elsewhere. The book is well written, easy to follow and displays clear writing style. I would strongly recommend it to everybody who is involved in running Apache web servers, web applications or has web security as part of his job responsibility. Obviously, everybody who thinks that this subject is fun should also read it :) Also, check out www.apachesecurity.net for some free chapters, ToC, tools covered in the book, as well as a couple presentations given by Ivan. The book focuses on the defensive side, but mentions various attacks against web infrastructure as well. Anton Chuvakin, Ph.D., GCIA, GCIH, GCFA is a Security Strategist with a major security company. He is an author of the book Security Warrior and a contributor to Know Your Enemy II and the upcoming Hacker`s Challenge III . In his spare time, he maintains his security portal infosecure.org and his blog at O`Reilly. His next book will be about security log analysis.
