Thanks a lot, we are very happy to have this book in our library!

I recently received copies of Apache Security (AS) by Ivan Ristic and Preventing Web Attacks with Apache (PWAWA) by Ryan Barnett. I read AS first, then PWAWA. Both are excellent books, but I expect potential readers want to know which is best for them. The following is a radical simplification, and I could honestly recommend readers buy either (or both) books. If you are more concerned with a methodical, comprehensive approach to securing Apache, choose AS. If you want more information on offensive aspects of Web security, choose PWAWA.

Author Ryan Barnett takes a wider look at the world of Web application security than Ivan Ristic. As a result I find their two books very complementary. You'll find coverage of topics in PWAWA that do not appear in AS. For example, Ryan explains how to use the Center for Internet Security Apache Benchmark Scoring Tool to evaluate your httpd.conf file. He uses the Apache Benchmark (ab) application (packaged with Apache) to measure Web server performance characteristics. He uses these tools in before-and-after situations to show how his recommended changes improve the defaults.

I thought PWAWA's coverage of the fundamentals of Web security was not as good as that of AS. That's ok, though, because PWAWA addresses areas not as well covered by AS. For example, PWAWA spends a lot of quality ink on mod_security filters. This is ironic, given that AS author Ivan Ristic coded mod_security! What's impressive about PWAWA's mod_security explanations are the many sample filters. These are developed after discussions of various attack techniques and serve as countermeasures one can implement until a patch is ready.

PWAWA is a mix of defense and offense, with a whole chapter showing how to attack and defend the WebMaven/Buggy Bank learning Web application. Attacks are nice, but showing development of defenses is excellent. PWAWA features some clever ideas too, like snort2modsec.pl and an Open Web Proxy Honeypot. I was not as keen on the inclusion of the Web Application Security Consortium's Web Security "Threat" Classification document. Please search my blog for a thorough discussion of why that guide should be an "attack, vulnerabilities, and exposures" document.

I found few technical nits. It's not correct that a NIDS protects its sniffing interface by "removing [the] IP stack" (p 299). Inline IDS isn't just for honeypots, either. I could have used inline packet rewriting to defend a Web hosting company that had lost control of its IIS customer sites. The customers were compromised and were unwittingly attaching malicious frames in their Web pages, thanks to an intruder.

I was also concerned by the author's statement that upon seeing a Snort Web attack alert, he connects to the Web server via SSH and begins reviewing logs (p 419). Proper network security monitoring wouldn't necessarily require immediate log review, and if log review is needed it should be done via a central log host. Connecting to a potential victim immediately after suspected compromise is a great way to alert the intruder and potentially alter evidence.

Overall, I liked PWAWA. The book is a mix of Apache security and Web application assessment, so if you are more interested in purely securing Apache you might prefer AS. If you want to learn about Web application hacking in general, your best bets are probably Hacking Exposed: Web Applications, 2nd Ed, and Professional Pen Testing for Web Applications. I will read and review those two books shortly.

I recently received copies of Apache Security (AS) by Ivan Ristic and Preventing Web Attacks with Apache (PWAWA) by Ryan Barnett. I read AS first, then PWAWA. Both are excellent books, but I expect potential readers want to know which is best for them. The following is a radical simplification, and I could honestly recommend readers buy either (or both) books. If you are more concerned with a methodical, comprehensive approach to securing Apache, choose AS. If you want more information on offensive aspects of Web security, choose PWAWA.

Author Ryan Barnett takes a wider look at the world of Web application security than Ivan Ristic. As a result I find their two books very complementary. You'll find coverage of topics in PWAWA that do not appear in AS. For example, Ryan explains how to use the Center for Internet Security Apache Benchmark Scoring Tool to evaluate your httpd.conf file. He uses the Apache Benchmark (ab) application (packaged with Apache) to measure Web server performance characteristics. He uses these tools in before-and-after situations to show how his recommended changes improve the defaults.

I thought PWAWA's coverage of the fundamentals of Web security was not as good as that of AS. That's ok, though, because PWAWA addresses areas not as well covered by AS. For example, PWAWA spends a lot of quality ink on mod_security filters. This is ironic, given that AS author Ivan Ristic coded mod_security! What's impressive about PWAWA's mod_security explanations are the many sample filters. These are developed after discussions of various attack techniques and serve as countermeasures one can implement until a patch is ready.

PWAWA is a mix of defense and offense, with a whole chapter showing how to attack and defend the WebMaven/Buggy Bank learning Web application. Attacks are nice, but showing development of defenses is excellent. PWAWA features some clever ideas too, like snort2modsec.pl and an Open Web Proxy Honeypot. I was not as keen on the inclusion of the Web Application Security Consortium's Web Security "Threat" Classification document. Please search my blog for a thorough discussion of why that guide should be an "attack, vulnerabilities, and exposures" document.

I found few technical nits. It's not correct that a NIDS protects its sniffing interface by "removing [the] IP stack" (p 299). Inline IDS isn't just for honeypots, either. I could have used inline packet rewriting to defend a Web hosting company that had lost control of its IIS customer sites. The customers were compromised and were unwittingly attaching malicious frames in their Web pages, thanks to an intruder.

I was also concerned by the author's statement that upon seeing a Snort Web attack alert, he connects to the Web server via SSH and begins reviewing logs (p 419). Proper network security monitoring wouldn't necessarily require immediate log review, and if log review is needed it should be done via a central log host. Connecting to a potential victim immediately after suspected compromise is a great way to alert the intruder and potentially alter evidence.

Overall, I liked PWAWA. The book is a mix of Apache security and Web application assessment, so if you are more interested in purely securing Apache you might prefer AS. If you want to learn about Web application hacking in general, your best bets are probably Hacking Exposed: Web Applications, 2nd Ed, and Professional Pen Testing for Web Applications. I will read and review those two books shortly.

It's a good book. I'm glad to have it. But I'm only giving it 4 stars, not 5. To me - not as mind blowing as some of the other people have said. I found some information not useful, but the other half is quite useful and going through the whole book is giving me confidence in my servers.

According to Netcraft's latest Website Server Survey (February 2006), over 68% of internet websites are hosted on Apache servers. This presents a large group of potential targets for malicious attacks.

'Preventing Web Attacks with Apache' attempts to provide a comprehensive treatment of the thorny area of web server security with the sole emphasis being on Apache. Initial doubts about the viability of a 500 page treatise on securing an Apache server were dispelled by the in-depth and thorough approach of the author.

The book kicks off by exposing common misconceptions about web server security. For example, the fact that web servers need to have ports 80 (http) and 443 (SSL) open in order to function properly means that the effectiveness of security measures such as firewalls, DMZs and intrusion detection systems is somewhat diminished.

The proper configuration of the underlying operating system is then highlighted as the first line of defence. Issues such as the timely application of vendor patches, disabling of non-essential services, user management and proper application of file permissions are addressed.

At this stage it is necessary to note that the author has tailored the book specifically to cater for the 2.0 version fork of Apache as opposed to the 1.3 version. This is in spite of the fact that the 1.3 legacy version holds the majority of market share. His reason is that the version 2.0 fork contains a number of new security features, amongst other improvements, which make it easier to secure. Therefore users of the 1.3 version will need to take this into account when reading the book. Obviously, the general principles of "OS-hardening" and other common features, which both forks still share, will ensure that the book is still a useful read for version 1.3 administrators.

The exhaustive approach is continued with a chapter dedicated to downloading and compiling the source code, while another 40-page chapter provides secure settings for httpd.conf, the primary configuration file for Apache. An interesting comparative exercise was performed using Nikto, the popular open-source vulnerability scanner. The scanner was run initially against a newly installed Apache server with the default configuration, and then again after httpd.conf had been "hardened" with revealing results.

Apache has been designed so that its functionality can be extended by the installation of additional modules. Chapter 5 deals with the installation and configuration of security-related modules that can be added to Apache in order to improve its security.

The installation and running of the CIS Apache Benchmark Scoring Tool rounds up the first part of the book, which concentrates on securing Apache and the underlying operating system. The second part of the book majors on the protection of web applications that run on top of Apache.

A vast array of possible web threats such as SQL injection attacks, cross-site scripting and path traversal attacks are detailed with corresponding countermeasures. These concepts are then applied to a suitably named demonstration web application called Buggy Bank. The use of web honeypots is also covered with a whole chapter on an open web proxy honeypot project conducted by the author.

Finally, a practical scenario is enacted to allow the application of appropriate Apache countermeasures to a vulnerability alert email. Step by step details are provided making use of skills acquired in the previous chapters.

This book will serve as a very useful tool to anyone charged with securing web servers, especially those running Apache. Concepts are clearly presented and then demonstrated using practical illustrations and examples.

I have to admit I am only half way through the book, but have to say that I am very impressed. First the book is very well written, clear and concise and does a great job of explaining technical terms a novice may not quite understand as he goes through the material. The author is able to provide a great deal of information in a smaller book as opposed to the larger "bibles" as he is able to get directly to the point. You can tell that the author has a clear grasp of the material from experience as opposed to merely theortical or academic research. The topics covered are eye opening and enlightning and through the reading of the book the reader comes to a better understanding not just of Apache security, but also of network and application security.

I would suggest this book even to anyone who works with Apache as their server of choice and not just security professionals, but also webmasters, web developers and even designers as the language and structure of the book is easy to follow and understand.

I should start with a disclaimer, I know Ryan Barnett and have followed his work through the years. That said, my responsibility as a reviewer is to help you as the reader decide whether to purchase this book, take the time to leaf through the book with the sample pages or Amazon, or to skip this book. I take that responsibility seriously.

If you have nothing to do with Web servers, you can safely skip this book. If you have operations, security or audit responsibilities for an organization that runs Apache and you do not read this book at least twice you are negligent. Please allow me to explain why I say that.

The book introduces the Center for Internet Security benchmark early on. This group, www.cisecurity.org, does two things very well, they determine to appropriate security configuration for a number of operating systems, devices, and programs and they produce tools to check the configuration. Wouldn't it make sense to know if your web server is configured properly, on average there are about 1,000 web defacements per day.

There are security books that about things and that is OK, but the best security books tell you how to do things. Ryan takes you through the download, installation and configuration of Apache. The "secret sauce" in the book starts in Chapter 5, where you are introduced to what is possible with the security modules for Apache. If you are an auditor, grab your highlighter, mark the tools and configurations and go pay the web admins a visit! Chapter 8 gives you a scenario to bring everything together. For the average reader, this is about as far as you are going to go.

Beyond Chapter 8, you are in advanced material, where Ryan is sharing the results of years of his research. This is for the security person looking for a bit of an edge to help protect their organization, or to do additional research. This is not a book for everyone, but it is a book for everyone running Apache!

This book is a well written, in depth, look into the security issues around Apache and applications developed on top of Apache. The content is relevant, well explained, and very useful to both applications engineers and network security folks. Definitely a must read for those looking to deploy high load applications on the open Internet.

Apache is the most common web server out there. It has been heavily built up in functionality by volunteer programmers. Naturally, there are numerous books detailing all that you can do with it. Very versatile. Unfortunately, that is one of the problems! As many commercial websites use Apache, there is a huge incentive for crackers to subvert it in various fashions. Perhaps to get at the back end SQL database. In which might be stored useful information like people's names and credit card data.

Barnett offers inoculation. You can read this book as the sysadmin's manual to installing and running Apache. Where the overriding priority is to bolt down any known weaknesses from the get go.

There is a comprehensive list of attacks. Some might not necessarily be directed against Apache per se, but against any web server. But there are others that might scan for particular versions of Apache or the operating system, if these have bugs that can be exploited. The text suggests possibly providing disinformation. In an earlier, more innocent time, a web server might write its name and version at the bottom of a page that it publishes, for example. Now, you are shown how Apache can suppress this. Better yet, you can tell Apache to pretend to be another web server. A defensive fib that makes the cracker's job a little harder.

Buffer overflows, cross site scripting and SQL injection are possibly the most dangerous attacks explained. For each attack, examples are usually given. Followed by Apache countermeasures. Tangentially, you also get to cast scrutiny at your database and at the entire way your multitier server system is arranged.

The book is a sad but necessary commentary on the times we live in.