Protecting Apache Web Server

---

Applies to SSHepherd 2.0

Overview

Apache Web Server runs a large share of the world’s web sites, so attackers scan for it constantly. With SSHepherd®, Apache listens only on the host itself, and authorized users reach it through a Generic tunnel. The web server keeps working for them, with no open port for anyone else to find.

Before you start

• The SSHepherd® Agent is installed on the Apache server.
• The Control App or shepctl is installed on the user’s computer.
• The user and the Apache server are in the same SSHepherd® group, or the user has a Generic tunnel definition for it.
• You’ve checked that the user can open an SSHepherd® tunnel to the server.

Configure the Apache server

These steps are for Apache on Debian or Ubuntu.

1. Make Apache listen only on localhost. Edit ports.conf: sudo nano /etc/apache2/ports.confChange the Listen line to: Listen 127.0.0.1:80
2. Save the file and restart Apache: sudo systemctl restart apache2
3. Allow port 80 on the agent:
   1. In the Administrator Console, click Agents and select the Apache server.
   2. Click the Settings tab.
   3. Add 80 to Allowed Ports.
   4. Click Save.
   The agent applies the change within seconds.

That’s all the setup the Apache server needs.

Access the web server with shepctl

1. Sign in with shepctl and open a tunnel, here on local port 8080: shepctl --hostname <apache server host name> --relayport 80 --port 8080 tunnel
2. In a web browser, open http://127.0.0.1:8080. The site’s home page loads.
3. Press Ctrl+C to close the tunnel. The site is no longer reachable until you open another tunnel.

Access the web server with the Control App

1. Ask your administrator for a Generic tunnel definition with To Agent set to the Apache server, Remote Host 127.0.0.1 and Remote Port 80. See Tunnel Definitions.
2. In the Control App, switch the tunnel on.
3. Open http://127.0.0.1:<local port> in a browser, using the tunnel’s local port.

Because of the way SSHepherd® works, you can do the same with almost any application that can listen on a specific port.