LinuxQuestions.org
Visit the LQ Articles and Editorials section
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 12-17-2004, 07:07 PM   #1
J_Szucs
Senior Member
 
Registered: Nov 2001
Location: Budapest, Hungary
Distribution: SuSE 6.4-11.3, Dsl linux, FreeBSD 4.3-6.2, Mandrake 8.2, Redhat, UHU, Debian Etch
Posts: 1,126

Rep: Reputation: 58
Is it possible to protect an old, unpached apache server?


I badly need a place where I could make just one single jpeg freely downloadable to the internet.

Presently we have no http servers aaccessible from the internet, but one that is only accessible from within our LAN. It is an unpatched, 4-years old apache installation on a FreeBSD 4.4 machine. There is no GUI on that machine, and it is in a non-unix network environment.

I wonder if I could put the jpeg on that http server and make it accessible to the internet?

(I have got no maintenance time for four years, so patching/upgrading the server is out of question, though our whole intranet relies on that FreeBSD machine)

I wonder if it is possible to start a new (virtual) http server on that machine that should have no access to any files on that machine except for that jpeg. It should listen on a non-http port, and that port could be forwarded to a non-http port of our firewall.

Hiding the server behind e.g. stunnel is, however, not possible, as the jpeg should be accessible without authentication.

How to start a virtual http server that only has access to one single file (though there is an other http server on the same machine that should have access and serve documents for the intranet), it does not serve e.g. php pages (though php pages should be accessible from within the LAN), it should listen on a different port.
I wonder if it would be too risky to put an unpatched apache on the internet even if those conditions can be fulfilled?
 
Old 12-18-2004, 03:24 AM   #2
/bin/bash
Senior Member
 
Registered: Jul 2003
Location: Indiana
Distribution: Mandrake Slackware-current QNX4.25
Posts: 1,802

Rep: Reputation: 46
http://www.free-webhosts.com/free-image-hosting.php
 
Old 12-18-2004, 04:10 AM   #3
Paiway
LQ Newbie
 
Registered: Dec 2004
Location: Sweden
Distribution: Debian ' Sid' 2.6.9
Posts: 14

Rep: Reputation: 0
www.imageshack.us
 
Old 12-18-2004, 12:33 PM   #4
TruckStuff
Member
 
Registered: Apr 2002
Posts: 498

Rep: Reputation: 30
Re: Is it possible to protect an old, unpached apache server?

Quote:
Originally posted by J_Szucs
(I have got no maintenance time for four years, so patching/upgrading the server is out of question, though our whole intranet relies on that FreeBSD machine)
How can you have no time to do maintenance on a server in 4 years?? Sounds like it can't be that critical of a server if patching isn't important...

At any rate, you should just make time to upgrade Apache. You can compile Apache2 from source in <15 minutes.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
How to protect my dedicated server and websites ? my-unix-dream Linux - Security 1 06-08-2005 10:48 AM
Apache 2.0, I want to list dir contents & password protect... Scrag Linux - Software 3 02-10-2005 11:38 AM
how do I poassword protect a directory on a website, Apache bentman78 Linux - Software 8 06-17-2004 11:12 AM
protect directories in apache Syncrm Linux - General 9 03-19-2002 11:52 AM
using apache to protect a directory Syncrm Linux - Networking 0 08-31-2001 04:54 AM


All times are GMT -5. The time now is 02:13 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration