Secure HTTP servers

Harden your HTTP servers, such as Apache and Nginx, to mitigate security risks. This involves configuring security options in the main configuration files and checking that scripts run correctly.

Security enhancements in httpd.conf
Copy link

You can enhance the security of the Apache HTTP server by configuring security options in the /etc/httpd/conf/httpd.conf file.

In the /etc/httpd/conf/httpd.conf file, you can configure the following options:

FollowSymLinks
This directive is enabled by default and follows symbolic links in the directory.
Indexes
This directive is enabled by default. Disable this directive to prevent visitors from browsing files on the server.
UserDir
This directive is disabled by default because it can confirm the presence of a user account on the system. To activate user directory browsing for all user directories other than /root/, use the UserDir enabled and UserDir disabled root directives. To add users to the list of disabled accounts, add a space-delimited list of users on the UserDir disabled line.
ServerTokens

This directive controls the server response header field which is sent back to clients. You can use the following parameters to customize the information:

ServerTokens Full

Provides all available information such as web server version number, server operating system details, installed Apache modules, for example:

Apache/2.4.37 (Red Hat Enterprise Linux) MyMod/1.2
ServerTokens Full-Release

Provides all available information with release versions, for example:

Apache/2.4.37 (Red Hat Enterprise Linux) (Release 41.module+el8.5.0+11772+c8e0c271)
ServerTokens Prod / ServerTokens ProductOnly

Provides the web server name, for example:

Apache
ServerTokens Major

Provides the web server major release version, for example:

Apache/2
ServerTokens Minor

Provides the web server minor release version, for example:

Apache/2.4
ServerTokens Min / ServerTokens Minimal

Provides the web server minimal release version, for example:

Apache/2.4.37
ServerTokens OS

Provides the web server release version and operating system, for example:

Apache/2.4.37 (Red Hat Enterprise Linux)

Use the ServerTokens Prod option to reduce the risk of attackers gaining any valuable information about your system.

Important

Do not remove the IncludesNoExec directive. By default, the Server Side Includes (SSI) module cannot run commands. Changing this can allow an attacker to enter commands on the system.

Securing CGI and script directories
Copy link

Ensure that only the root user has write permissions to directories containing scripts or Common Gateway Interfaces (CGI):

# chown root <directory_name>
# chmod 755 <directory_name>

Always verify that all scripts work correctly before putting them into production.

Removing httpd modules
Copy link

You can remove the httpd modules to limit the functionality of the HTTP server. To do so, edit configuration files in the /etc/httpd/conf.modules.d/ or /etc/httpd/conf.d/ directory. For example, to remove the proxy module:


        echo '# All proxy modules disabled' > /etc/httpd/conf.modules.d/00-proxy.conf

Nginx server configuration hardening
Copy link

Harden your Nginx HTTP and proxy server configuration by adjusting security options. This helps protect your system against common web application vulnerabilities.

Configure the following security options to protect against common web application vulnerabilities:

  • To disable version strings, modify the server_tokens configuration option: 
    server_tokens off;

    This option stops displaying additional details such as server version number. This configuration displays only the server name in all requests served by Nginx, for example:

    $ curl -sI http://localhost | grep Server
Server: nginx
  • Add security headers in your server or location blocks within /etc/nginx/nginx.conf or /etc/nginx/conf.d/*.conf files:
    • For example, the X-Frame-Options header option denies any page outside of your domain to frame any content served by Nginx, mitigating clickjacking attacks: 
      add_header X-Frame-Options "SAMEORIGIN";
    • For example, the x-content-type header prevents MIME-type sniffing in certain older browsers: 
      add_header X-Content-Type-Options nosniff;
    • For example, the X-XSS-Protection header enables Cross-Site Scripting (XSS) filtering, which prevents browsers from rendering potentially malicious content included in a response by Nginx: 
      add_header X-XSS-Protection "1; mode=block";
  • You can limit the services exposed to the public and limit what they do and accept from the visitors, for example: 
    limit_except GET {
    allow 192.168.1.0/32;
    deny  all;
}

    The snippet will limit access to all methods except GET and HEAD.

  • You can disable HTTP methods, for example: 
    # Allow GET, PUT, POST; return "405 Method Not Allowed" for all others.
if ( $request_method !~ ^(GET|PUT|POST)$ ) {
    return 405;
}
  • Configure TLS to protect data served by your Nginx web server. Serve content over HTTPS only. You can generate a secure configuration profile for enabling TLS in your Nginx server using the Mozilla SSL Configuration Generator. The generated configuration ensures that known vulnerable protocols, ciphers, and hashing algorithms are disabled. Use the SSL Server Test to verify that your configuration meets modern security requirements.