no way to compare when less than two revisions
Differences
This shows you the differences between two versions of the page.
| — | apache_security [2014/02/14 23:07] (current) – created - external edit 127.0.0.1 | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| + | ====== Apache Security ====== | ||
| + | |||
| + | * [[Apache]] | ||
| + | * [[Apache Server Info]] | ||
| + | * [[Apache SSL]] | ||
| + | * [[Apache suExec]] | ||
| + | * [[CentOS Apache Security]] | ||
| + | |||
| + | Some ways to increase security using Apache 2.2. | ||
| + | |||
| + | * [[http:// | ||
| + | |||
| + | ==== mod_core ==== | ||
| + | |||
| + | == Minimal server info == | ||
| + | |||
| + | < | ||
| + | # ServerTokens | ||
| + | # This directive configures what you return as the Server HTTP response | ||
| + | # Header. The default is ' | ||
| + | # and compiled in modules. | ||
| + | # Set to one of: Full | OS | Minor | Minimal | Major | Prod | ||
| + | # where Full conveys the most information, | ||
| + | ServerTokens Prod | ||
| + | </ | ||
| + | |||
| + | == Lower timeout == | ||
| + | |||
| + | The default values (CentOS: 120, Gentoo: 300) are high, and can be reduced to help mitigate a denial of service, unintentional or otherwise. | ||
| + | |||
| + | < | ||
| + | # Timeout: The number of seconds before receives and sends time out. | ||
| + | Timeout 45 | ||
| + | </ | ||
| + | |||
| + | == Disable trace behavior == | ||
| + | |||
| + | < | ||
| + | # TraceEnable | ||
| + | # This directive overrides the behavior of TRACE for both the core server and | ||
| + | # mod_proxy. The default TraceEnable on permits TRACE requests per RFC 2616, | ||
| + | # which disallows any request body to accompany the request. TraceEnable off | ||
| + | # causes the core server and mod_proxy to return a 405 (Method not allowed) | ||
| + | # error to the client. | ||
| + | # For security reasons this is turned off by default. (bug #240680) | ||
| + | TraceEnable off | ||
| + | </ | ||
| + | |||
| + | == Disable server signature == | ||
| + | |||
| + | < | ||
| + | # Optionally add a line containing the server version and virtual host | ||
| + | # name to server-generated pages (internal error documents, FTP directory | ||
| + | # listings, mod_status and mod_info output etc., but not CGI generated | ||
| + | # documents or custom error documents). | ||
| + | # Set to " | ||
| + | # Set to one of: On | Off | EMail | ||
| + | ServerSignature Off | ||
| + | </ | ||
| + | |||
| + | == Disable range headers == | ||
| + | |||
| + | < | ||
| + | RequestHeader unset Range | ||
| + | </ | ||
| + | |||
| + | Note that this may break certain clients - such as those used for e-Readers and progressive/ | ||
| + | |||
| + | Furthermore to ignore the Netscape Navigator 2-3 and MSIE 3 specific legacy header - add: | ||
| + | |||
| + | < | ||
| + | |||
| + | == Disable FileEtag == | ||
| + | |||
| + | < | ||
| + | |||
| + | == Ignore client requests with indexes == | ||
| + | |||
| + | < | ||
| + | |||
| + | == Message digests == | ||
| + | |||
| + | * [[http:// | ||
| + | |||
| + | Adds an integrity check useful for proxies and clients. | ||
| + | |||
| + | < | ||
| + | ContentDigest On | ||
| + | </ | ||
| + | |||
