Madhav Kobal's Blog

This blog will be dedicated to Linux, Open Source and Technology news, affairs, how-tos and virtually EVERYTHING in these domains.

Posts Tagged ‘Web’

Microsoft Office Goes Online For Free!

Posted by madhavkobal on 20/08/2009

With an aim to kill Google Docs, Microsoft announces a free Web-based version of Office 2010.

The technical preview version of Microsoft Office 2010, (codenamed Office 14) the successor of Microsoft Office 2007, has been released by the software major. Most interestingly, Microsoft has also announced a free Web-based version of its Office productivity suite, known as Office Web Applications. The radical move by Microsoft is a direct challenge to its arch rival Google and its online office productivity suite, Google Apps.

Office Web will include free online versions of Word, Excel, PowerPoint and OneNote which will work in the three Web browsers (Microsoft Internet Explorer, Mozilla Firefox and Apple Safari).

Giving a tough competition to Google Docs, Office Web Applications will enable multiple people to simultaneously work on the same document, whether it’s in Microsoft Word, Excel, PowerPoint or OneNote. It will also allow users to create, edit, access and share Office documents directly in the browser.

The Office Web Applications will also feature user interfaces similar to their desktop counterparts. The new versions of Outlook, OneNote, Publisher and SharePoint Server now have ribbon-based interfaces, which can be customised.

Analysts say the new Office Web Applications seem to be far more powerful than Google’s online applications and should offer much better compatibility with Microsoft Office files.

Office Web Applications can also be used with any mobile phone that has a compatible microbrowser. The company is also streamlining the number of Office editions from eight to five and enhancing each edition with additional applications and features.

“Office 2010 is the premier productivity solution across PCs, mobile phones and browsers,” said Chris Capossela, senior vice president, Microsoft business division, Microsoft. “From broadcast and video editing in PowerPoint, new data visualisation capabilities in Excel, and co-authoring in Word, we are delivering technology to help people work smarter and faster from virtually any location using any device.”

Office 2010 and related products will be available in the first half of 2010.

Posted in Uncategorized | Tagged: , , , | Leave a Comment »

Five ways to help secure Apache on Linux

Posted by madhavkobal on 20/08/2009

Apache is one of the most popular server available. And most Apache installations are running on Linux servers. Anyone running Linux will tell you that the operating system (be it on a server or desktop) enjoys a level of security operating systems do not enjoy. But does that mean you can just install Apache and assume it 100% safe? No. There are always ways to improve your security on just about every level.

In this article I will show you five simple ways to make your Linux Apache installation more secure. And of course you should always know that even with five new means of making your install more secure, that doesn’t mean it is perfectly safe from attack. Even after securing your installation, you should always keep watch over your server by checking log files and using standard security tools.

With that said, let’s get our Apache security on!

1. Update, update, update! One of the biggest no nos Linux administrators make is to “set it and forget it”. This should not be your standard policy. There are always updates that close new holes and patch security flaws. This holds true for Apache as much as it does any other system or . Keep watch, using your normal means of update, for any security update for Apache or any constituent component you have installed. By doing this you will ensure your web server is safe from any new known issues.

2. Disable modules you do not use. If you check the Apache configuration file. Most often this file is called httpd.conf and its location will depend upon what distribution you are running (For example CentOS has this file in /etc/httpd/conf/ whereas Ubuntu locates it in /etc/apache2). If you examine that file you will see quite a few modules listed. These modules will look like:

LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule auth_digest_module modules/mod_auth_digest.so
LoadModule authn_file_module modules/mod_authn_file.so
LoadModule authn_alias_module modules/mod_authn_alias.so
LoadModule authn_anon_module modules/mod_authn_anon.so

You might have to look up what some of these modules do to know if you need them or not. But there is no reason to load a module if you are not going to use it. To keep a module from loading place a comment in front of the line. You will have to restart Apache for this change to take effect.

3. Limit the request sizes allowed. Denial of Service attacks remain one of the most popular attacks on web sites because they are the easiest to pull off. One way to protect your site from DoS attacks is to use the following directives wisely: LimitRequestBody, LimitRequestFields, LimitRequestFieldSize, LimitRequestLine, and LimitXMLRequestBody within a Directory tag (the document root is probably the best place for this). By default Apache sets these directives to unlimited which means any size of request can be made. You will want to investigate these directives and configure them to suit your web sites needs. Unless it is absolutely necessary, do not set them to unlimited.

4. Use mod_security. This is the most important module you can use. This one module handles such tasks as: Simple filtering, regular expression filtering, server identity masking, and URL encoding validation. It is likely you will have to install mod_security, because the default Apache install does not include this module. Once installed you will want to make sure you at least add the “unique_id” and “security2″ directives in your Apache module section and then restart Apache. I will deal with this module in its own tutorial coming up very soon.

Figure 1Figure 1

5. Restrict browsing to your document root. The last thing you want is to allow browser to peek outside of the Apache document root (Such as /var/www/html or /var/www/). To do this you will want to configure your document root directory entry as shown in Figure 1. This will

Of course if you want to add options to any directory inside of the document root you will have to give that directory its own Directory entry.

Final thoughts

There are plenty more ways to secure your Apache installation, but these will get you started. Can you think of other ways to secure an Apache installation? If so, share them with your fellow ghacks readers.

Posted in Apache, Security, Server, Web | Tagged: , , , | Leave a Comment »