Table of Contents
Advertisement
Knowing Your Server's Limits
The server offers secure connections between the server and the client. It can't
control the security of information once the client has it, nor can it control access to
the server machine itself and its directories and files.
Being aware of these limitations helps you understand what situations to avoid.
For example, you might acquire credit card numbers over an SSL connection, but
are those numbers stored in a secure file on the server machine? What happens to
those numbers after the SSL connection is terminated? You should be responsible
for securing any information clients send to you through SSL.
Making Additional Changes to Protect Servers
If you want to have both protected and unprotected servers, you should operate
the unprotected server on a different machine from the protected one. If your
resources are limited and you must run an unprotected server on the same
machine as your protected server, do the following.
•
Assign proper port numbers. Make sure that the protected server and the
unprotected server are assigned different port numbers. The registered default
port numbers are:
443 for the protected server
80 for the unprotected server
•
For UNIX or Linux, enable the
The unprotected server should have references to its document root redirected
using
.
chroot
allows you to create a second root directory to limit the server to specific
chroot
directories. You'd use this feature to safeguard an unprotected server. For example,
you could say that the root directory is
to access the root directory, it really gets
and so on. This allows you to run the web server on your UNIX/Linux
/d1/ms/dev
system, without giving it access to all the files under the actual root directory.
However, if you use
required by Enterprise Server under the alternative root directory, as shown in the
following illustration:
chroot
/d1/ms
/d1/ms
, you need to set up the full directory structure
chroot
Considering Additional Security Issues
feature for the document root directory.
. Then any time the web server tries
. If it tries to access
Chapter 5
Securing Your Enterprise Server
, it gets
/dev
133
Advertisement
Table of Contents
