32. Linux and Network Hardening
32.5 Web Server Hardening
Apache (/etc/httpd/conf/httpd.conf or a file in /etc/httpd/conf.d/):
ServerTokens Prod
ServerSignature Off
TraceEnable Off
<Directory /var/www/html>
Options -Indexes -Includes
AllowOverride None
</Directory>
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set Content-Security-Policy "default-src 'self'"
Nginx (inside http {} or the server {} block):
server_tokens off;
autoindex off;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
client_max_body_size 10m;
limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;
PHP (/etc/php.ini): expose_php = Off, display_errors = Off, allow_url_include = Off, and disable_functions = exec,passthru,shell_exec,system if your app does not need them.
Always keep HTTPS with a valid certificate (Chapter 11) and redirect HTTP to HTTPS. Test and reload:
sudo apachectl configtest && sudo service httpd reload
sudo nginx -t && sudo service nginx reload
curl -I https://reels.example.in # check the headers
A WAF (web application firewall) such as ModSecurity or AWS WAF adds another layer against SQLi and XSS, but it never replaces fixing the code (Chapter 29).
Ravindra Bagale's Tip
If you set a very strict Content-Security-Policy, the site's CSS/JS gets blocked and students end up removing the header altogether. First test with Content-Security-Policy-Report-Only, look in the browser console to see what gets blocked, and then apply the real header.
Ravindra Bagale's Tip – मराठी
Content-Security-Policy एकदम कडक लावला तर site चे CSS/JS बंद होतात आणि students तर header च काढून टाकतात. आधी Content-Security-Policy-Report-Only ने test करा, browser console मध्ये काय block होते ते बघा, मग खरा header लावा.
Ravindra Bagale's Tip – हिंदी
Content-Security-Policy बहुत सख़्त लगाया तो site के CSS/JS बंद हो जाते हैं और students header ही हटा देते हैं. पहले Content-Security-Policy-Report-Only से test करो, browser console में देखो क्या block हो रहा है, फिर असली header लगाओ.
Lab
Run Nikto (Chapter 20) against your lab web server and save the output. Apply the Apache or Nginx settings above plus the PHP settings, reload, and run Nikto again. List which findings disappeared and check the new headers with curl -I.