Archive
Posts in Web
Dumping HTTP requests and reponses to the Apache error log
When debugging problems with web applications, it is often useful to display the HTTP request and response headers along with the HTTP entity bodies. There are numerous ways to do this, and I covered several client centric solutions in my SysAdmin article Debugging Web Applications. Client side tools are extremely useful for pinpointing problems, but periodically it is helpful to see the raw requests from the client, and the responses from the server. If you happen to be running Apache, you can use the dumpio module to dump the request and response data to the Apache error log…
$ read more →Securing PHP installations
I have been using PHP for quite some time, and have developed a love-hate relationship with it. The ability to rapidly create dynamic web applications is extremely powerful, but PHP's absymal security track record often leads me to wonder if I should be using it (especially since a fair number of opensource PHP applications are poorly coded, and using them can put your hosting platform at risk). Over the past few months, I have spent a fair amount of time researching ways to protect my PHP enabled web servers from insecure code, and unknown PHP vulnerabilities. There are a number of ways you can tackle PHP security, the most important being designing and writing secure PHP code…
$ read more →Apache mod_rewrite security flaw
It looks like a nasty security bug was discovered in the Apache mod_rewrite module, and new versions of Apache were released to address the problem. For those folks using mod_rewrite, it's time to patch.
$ read more →Tuning Apache for performance
I recently came across Colm MacCarthaigh's Apache tuning presentation and technical white paper: Tuning Apache and Linux for performance presentation: Tuning Apache and Linux for performance paper: Colm is an admin at heanet, which runs some of the busiest web servers in the world. The presentation and white paper cover the entire software stack, which includes kernel, file system and of course Apache web server tuning. These are must reads for website administrators.
$ read more →PHP security links
While reading up on PHP security, I came across several links that I thought I would pass on: Security Focus article on securing PHP installations: Article on PHP attack vectors and defenses: Bugtraq discussion on PHP security:
$ read more →