Red Hat Summit 红帽全球峰会支持控制台（Console）开发人员开始试用联系人

8.5. Securing HTTP servers

Harden your HTTP servers, such as Apache and Nginx, to mitigate security risks. This involves configuring security options in the main configuration files and checking that scripts run correctly.

8.5.1. Security enhancements in httpd.conf
复制链接

You can enhance the security of the Apache HTTP server by configuring security options in the /etc/httpd/conf/httpd.conf file.

Always verify that all scripts running on the system work correctly before putting them into production.

Ensure that only the root user has write permissions to any directory containing scripts or Common Gateway Interfaces (CGI). To change the directory ownership to root with write permissions, enter the following commands: 

# chown root <directory_name>
# chmod 755 <directory_name>

In the /etc/httpd/conf/httpd.conf file, you can configure the following options:

FollowSymLinks
This directive is enabled by default and follows symbolic links in the directory.
Indexes
This directive is enabled by default. Disable this directive to prevent visitors from browsing files on the server.
UserDir
This directive is disabled by default because it can confirm the presence of a user account on the system. To activate user directory browsing for all user directories other than /root/, use the UserDir enabled and UserDir disabled root directives. To add users to the list of disabled accounts, add a space-delimited list of users on the UserDir disabled line.
ServerTokens

This directive controls the server response header field which is sent back to clients. You can use the following parameters to customize the information:

ServerTokens Full

Provides all available information such as web server version number, server operating system details, installed Apache modules, for example: 

Apache/2.4.37 (Red Hat Enterprise Linux) MyMod/1.2
ServerTokens Full-Release

Provides all available information with release versions, for example: 

Apache/2.4.37 (Red Hat Enterprise Linux) (Release 41.module+el8.5.0+11772+c8e0c271)
ServerTokens Prod / ServerTokens ProductOnly

Provides the web server name, for example: 

Apache
ServerTokens Major

Provides the web server major release version, for example: 

Apache/2
ServerTokens Minor

Provides the web server minor release version, for example: 

Apache/2.4
ServerTokens Min / ServerTokens Minimal

Provides the web server minimal release version, for example: 

Apache/2.4.37
ServerTokens OS

Provides the web server release version and operating system, for example: 

Apache/2.4.37 (Red Hat Enterprise Linux)

Use the ServerTokens Prod option to reduce the risk of attackers gaining any valuable information about your system.

重要

Do not remove the IncludesNoExec directive. By default, the Server Side Includes (SSI) module cannot run commands. Changing this can allow an attacker to enter commands on the system.

8.5.1.1. Removing httpd modules
复制链接

You can remove the httpd modules to limit the functionality of the HTTP server. To do so, edit configuration files in the /etc/httpd/conf.modules.d/ or /etc/httpd/conf.d/ directory. For example, to remove the proxy module: 

echo '# All proxy modules disabled' > /etc/httpd/conf.modules.d/00-proxy.conf

8.5.2. Nginx server configuration hardening
复制链接

Harden your Nginx HTTP and proxy server configuration by adjusting security options. This helps protect your system against common web application vulnerabilities.

Nginx is a high-performance HTTP and proxy server. You can harden your Nginx configuration with the following configuration options:

  • To disable version strings, modify the server_tokens configuration option: 

    server_tokens off;

    This option stops displaying additional details such as server version number. This configuration displays only the server name in all requests served by Nginx, for example: 

    $ curl -sI http://localhost | grep Server
Server: nginx

  • Add extra security headers that mitigate certain known web application vulnerabilities in specific /etc/nginx/ conf files:

    • For example, the X-Frame-Options header option denies any page outside of your domain to frame any content served by Nginx, mitigating clickjacking attacks: 

      add_header X-Frame-Options "SAMEORIGIN";

    • For example, the x-content-type header prevents MIME-type sniffing in certain older browsers: 

      add_header X-Content-Type-Options nosniff;

    • For example, the X-XSS-Protection header enables Cross-Site Scripting (XSS) filtering, which prevents browsers from rendering potentially malicious content included in a response by Nginx: 

      add_header X-XSS-Protection "1; mode=block";

  • You can limit the services exposed to the public and limit what they do and accept from the visitors, for example: 

    limit_except GET {
    allow 192.168.1.0/32;
    deny  all;
}

    The snippet will limit access to all methods except GET and HEAD.

  • You can disable HTTP methods, for example: 

    # Allow GET, PUT, POST; return "405 Method Not Allowed" for all others.
if ( $request_method !~ ^(GET|PUT|POST)$ ) {
    return 405;
}
  • You can configure TLS to protect the data served by your Nginx web server, consider serving it over HTTPS only. Furthermore, you can generate a secure configuration profile for enabling TLS in your Nginx server using the Mozilla SSL Configuration Generator. The generated configuration ensures that known vulnerable protocols (for example, SSLv2 and SSLv3), ciphers, and hashing algorithms (for example, 3DES and MD5) are disabled. You can also use the SSL Server Test to verify that your configuration meets modern security requirements.
Red Hat logoGithubredditYoutubeTwitter

学习

尝试、购买和销售

社区

关于红帽文档

通过我们的产品和服务，以及可以信赖的内容，帮助红帽用户创新并实现他们的目标。 了解我们当前的更新.

让开源更具包容性

红帽致力于替换我们的代码、文档和 Web 属性中存在问题的语言。欲了解更多详情，请参阅红帽博客.

關於紅帽

我们提供强化的解决方案，使企业能够更轻松地跨平台和环境（从核心数据中心到网络边缘）工作。

Theme

© 2026 Red Hat返回顶部