Home Web Server: Security

Set MySQL password Home Web Server Uniform Server 3.5-Apollo.

Uniform server has a number of security features accessible and set from apanel. The server default installation is a total lock down for local access only, denying any external access. To put the servers on-line you need to disable this feature.

To initially gain access to the MySQL server a memorable password (root) is set as default, after every new installation this must be set to a new value especially when you put the servers on-line.

This page covers the above two security features in detail. What I do not cover here are name/password protection of the main server and apanel. If you want a private server or to put apanel on-line you would use this name/password feature however for a public web server they are not required.

Set MySQL Password

The MySQL server requires a new password the default is known and compromises the security of your server. Uniform server makes it very easy to change, choose a password with strong security. The ideal is a minimum of eight characters in length with a mixture of upper and lower letters and digits. (Allowed characters (a to z and A to Z and 0 to 9 Do not use any other characters).

Set the password as follows:

1  Start the servers by double-clicking on Server_Start.bat (in folder Uniform Server) 2 Your browser will start and display apanel. Note: You can run apanel at anytime by typing the following into your browser http://localhost/apanel/ 3 A) With apanel displayed scroll down to the Configurations section of the left menu. Click MySQL Server Configuration at the bottom of this section. 4 B) The MySQL Server Configuration page is displayed. 5 C) Type in the new MySQL Password. 6 D) Click Change 7 Stop the servers by double-clicking on Stop.bat (in folder Uniform Server) 8 Note: The password will updated when the servers are re-started.

Top

Put servers on-line

Apache validates access requests by first checking its configuration settings and then the settings in all files named .htaccess. The .htaccess file in the web-root folder www protects access to this folder and all sub-folders.

There are three lines in this file as follows:

• Order Deny,Allow
• Deny from all
• Allow from 127.0.0.1

The first line instructs Apache to execute the commands Deny and Allow in the order specified.

It first looks for the command Deny which states deny access from all (no one can access this folder or any of its sub-folders)

The next command it looks for is Allow, this modifies the deny command, however it is very specific and allows access only from port 127.0.01 (Localhost the PC that Apache is running on)

Apache’s sole task is to server pages unless instructed otherwise. Delete the above lines and your servers are placed on-line. However it is normal practice not to delete these lines but to convert them into comments that are ignored by Apache. A command is converted into a comment by placing a crosshatch symbol # at the beginning of the line.

.htaccess

To put your servers on-line open the file .htaccess in folder C:\uniserver\Uniform Server\udrive\www in a text editor such as NotePad and comment the lines as shown:

# This file provides security to the server limiting access to the localhost only. # Comment to deactivate. #Order Deny,Allow #Deny from all #Allow from 127.0.0.1 # To disallow execution of cgi scripts in this directory comment next two lines. AddHandler cgi-script .bat .exe .pl .cgi Options +ExecCGI #-- # Activate this to use the Admin Panel Feature! #-- # To lock Admin Panel, uncomment the next 4 lines. # Defaults: Username - root; Password - root #AuthName "Uniform Server - Admin Panel 2.0" #AuthType Basic #AuthUserFile /htpasswd/home/admin/www/.htpasswd #Require valid-user

Save the file, when requests come in, Apache will server pages from the web-root folder www place your web site in this folder for all the world to see.

Top

---

Ric