Apache Virtual Host: Adding Security

To ensure security when setting up a reverse proxy with Apache, you can implement several best practices, such as enabling HTTPS with SSL/TLS, adjusting security headers, configuring firewall, and securing access to the backend. Below is a detailed implementation for you to ensure a more secure environment.

Enable HTTPS with SSL/TLS

Using HTTPS is essential to protect data between the client and the server. To do this, we will configure an SSL certificate in Apache.

1.Install Certbot and Apache SSL Modules

If you don't already have the SSL modules installed, install them:

sudo apt install certbot python3-certbot-apache
sudo a2enmod ssl

2.Get an SSL Certificate (Let's Encrypt)

If your domain is already pointing to the server, you can get a free SSL certificate from Let's Encrypt with Certbot. Run the following command:

sudo certbot --apache -d php.info

If the domain is public, replace php.info with your actual domain.
Certbot will automatically configure SSL on your Virtual Host and redirect HTTP traffic to HTTPS.

3.Verify and Adjust the Virtual Host SSL

After configuration, Certbot will create or modify the Virtual Host SSL configuration file. Check if everything is correct:

sudo your_editor /etc/apache2/sites-available/php-le-ssl.conf

It should look something like this:

<IfModule mod_ssl.c>
    <VirtualHost *:443>
        ServerAdmin webmaster@localhost
        ServerName php.info
        DocumentRoot /var/www/html/php

        # Reverse Proxy Configuration for HTTPS
        ProxyPreserveHost On
        ProxyPass / http://localhost:8080/
        ProxyPassReverse / http://localhost:8080/

        <Directory /var/www/html/php/>
            AllowOverride All
            Require all granted
        </Directory>

        ErrorLog ${APACHE_LOG_DIR}/php_error.log
        CustomLog ${APACHE_LOG_DIR}/php_access.log combined

        SSLEngine on
        SSLCertificateFile /etc/letsencrypt/live/php.info/fullchain.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/php.info/privkey.pem
        Include /etc/letsencrypt/options-ssl-apache.conf
    </VirtualHost>
</IfModule>

Redirect HTTP to HTTPS

You can ensure that all HTTP traffic is redirected to HTTPS. In your HTTP Virtual Host (/etc/apache2/sites-available/php.conf), add:

<VirtualHost *:80>
    ServerAdmin webmaster@localhost
    ServerName php.info
    Redirect permanent / https://php.info/
</VirtualHost>

This will ensure that any HTTP requests will be redirected to the secure (HTTPS) version of the site.

Security Headers

Add the following security headers to your SSL Virtual Host configuration file to mitigate some common vulnerabilities such as Clickjacking and Cross-Site Scripting (XSS):

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    Header always set Content-Security-Policy "default-src 'self';"
</IfModule>

X-Content-Type-Options: Prevents the browser from trying to guess the content type, mitigating MIME sniffing attacks.
X-Frame-Options: Prevents the use of the site in iframes, protecting against clickjacking.
X-XSS-Protection: Enables protection against XSS attacks in browsers.
Strict-Transport-Security: Forces the browser to always use HTTPS.
Content-Security-Policy: Defines content loading policies to prevent attacks such as XSS.

Securing the Backend

You must ensure that the backend service, such as a PHP server or other service, is not directly accessible by the public. This can be done by restricting access to the backend to the proxy only.

Configure the Firewall (UFW on Ubuntu):

First, allow only HTTP (port 80) and HTTPS (port 443) traffic to the server.

sudo ufw allow 'Apache Full'
sudo ufw enable

Now, block any direct traffic to port 8080 (the backend), except for Apache:

sudo ufw deny 8080

Monitoring and Logs

Keep an active eye on access and error logs to monitor for suspicious behavior:

Access error logs:

tail -f /var/log/apache2/php_error.log

Access access logs:

tail -f /var/log/apache2/php_access.log

You can also use a monitoring tool, such as Fail2Ban, to automatically block IP addresses that make too many failed login attempts or other suspicious activity.

Regular Updates

Keeping your operating system, Apache, and Certbot up to date is essential to ensuring that you are protected against known vulnerabilities.

sudo apt update && sudo apt upgrade

By following these steps, you will have a secure reverse proxy environment with HTTPS and basic protection against common attacks. These settings cover transport security (SSL/TLS), mitigating attacks via HTTP headers, and protecting the backend from external access.

Blog