Hide Apache Httpd Version in HTTP Header

Hiding software version in any deployment is a basic security practice that we can use to lower the risk of the deployment being breached. In this post, we will see how we can hide the apache httpd version from the http header, and from server generated pages.

To check our header, just use curl. Let's say we have an apache httpd server running on localhost

$ curl --header http://localhost

The version will also showing in the server generated page, like when we tried to access non existent page

$ curl --header http://localhost/error

To hide the version number, we can just add below line into httpd.conf. I usually will put it at the bottom of the configuration file. The location of the httpd.conf will varies depending on how you install httpd. The usual location is at /etc/httpd/conf/httpd.conf:

ServerToken Prod

ServerSignature Off

"ServerToken Prod" will hide apache httpd version from http header, while "ServerSignature Off" will hide the version from server generated pages.

Example is like below

To make sure that our change is syntax error free, test with "apachectl -t"

Once we are satisfied, restart apache httpd

# systemctl restart httpd

Then, we test it back using curl, and we do not see the version anymore

$ curl --head http://localhost

$ curl --head http://localhost/error

Testing SSL Certs Using Apache on Docker

Sometimes we have a need to test our SSL, before we deploy it to production. If we have a development or staging environment, then we can test it there. But if we do not have that, we can always rely on trusty old docker to test the ssl in our own machine. Please follow along to learn how to do it.

Pre-requisite:

- have docker installed 

1. Put our ssl cert, intermediate cert (if we have one) and key into our current directory. Rename them as server.crt, server.key and server-ca.crt

2. Prepare a configuration file like below inside our current directory, and save it as https.conf

Listen 443

<VirtualHost _default_:443>

  DocumentRoot "/usr/local/apache2/htdocs"

  ServerName linuxwave.info

  ServerAdmin me@linuxwave.info

  ErrorLog /proc/self/fd/2

  TransferLog /proc/self/fd/1

  SSLEngine on

  SSLCertificateFile "/ssl/server.crt"

  SSLCertificateKeyFile "/ssl/server.key"

  SSLCertificateChainFile "/ssl/server-ca.crt"

</VirtualHost>

3. Run a container based on the httpd image from dockerhub, and mount the current folder with our ssl key and certs into /ssl in the container

docker run -dit --name apache -v ${PWD}:/ssl httpd

4. Copy /usr/local/apache2/conf into /ssl, so that we can edit it inside our host machine

docker exec -it apache cp /usr/local/apache2/conf/httpd.conf /ssl

5. Enable ssl in apache config by adding these lines into httpd.conf. We can just edit the file in our host machine, since text editor is not installed by default inside the apache image. The first 2 lines are to enable ssl support for apache, and the last line is for apache to include any files that end with .conf into its configuration

LoadModule ssl_module modules/mod_ssl.so

LoadModule socache_shmcb_module modules/mod_socache_shmcb.so

Include conf/extra/https.conf

6. Copy the edited httpd.conf file back into its original location

docker exec -it apache cp /ssl/httpd/conf /usr/local/apache2/conf

7. Create a symlink from /ssl/https.conf into /usr/local/apache2/conf/extra/

docker exec -it apache ln -s /ssl/https.conf /usr/local/apache2/conf/extra

8. Test the configuration file

docker exec -it apache httpd -t

9. If no error was found from the above command, restart the container

docker restart apache

10. Open a new terminal, and get the ip address of the container

docker inspect apache | grep IPAddress

11. Put the ip address and your hostname inside your machine's /etc/hosts

echo "172.17.0.2 linuxwave.info" | sudo tee -a /etc/hosts 

12. Try to access the above domain using a web browser, and check the ssl cert information

13. If the ssl certs are working fine inside docker, you can be sure that it will work just fine in your production server

How to Redirect HTTP Traffic to HTTPS in httpd on CentOS

The easiest way is to do it using the VirtualHost configuration, if you have control over it. 

Edit your virtualhost configuration for that domain, in CentOS it is usually located in /etc/httpd/conf.d/mydomain.conf:

<VirtualHost *:80>

   ServerName www.mydomain.com

   Redirect / https://www.mydomain.com

</VirtualHost>

<VirtualHost _default_:443>

   ServerName www.mydomain.com

   DocumentRoot /usr/local/apache2/htdocs

   SSLEngine On

...

</VirtualHost>

The most important line is the "Redirect" line which will redirect all http traffic to https.

Once done, save the file.

Do not forget to run syntax test of the configuration files.

# httpd -t

And reload the service

# systemctl reload httpd

Access Your Android Phone's Storage, using Commands

There are a lot of apps for android, that enable file sharing over wifi. Some of them are free, and some of them are paid. But in this article, I will be sharing a kind of geek way on how to share your android phone's internal storage with your linux machine.

Install an app called termux from the play store. Download the app here: https://play.google.com/store/apps/details?id=com.termux . This app will add terminal emulation to your android

Once installed, allow termux to access to storage. You can do that by going to Settings --> Apps & Notifications --> Termux --> Permissions, and enable Storage

Optional: to make your typing experience better, I recommend this keyboard app: https://play.google.com/store/apps/details?id=org.pocketworkstation.pckeyboard

The http server of our choice is, the python's simple-http server. To use the simple-http, first you need to install python. Run below in your termux console

$ pkg install python -y

Get your phone's ip address. This can be easily done in termux

$ ip a | grep wlan0

Run http.server, to share your phone's internal storage over the wifi. /storage/emulated/0 is the default root directory for android phone's internal storage

$ python -m http.server /storage/emulated/0 

In your PC/laptop/other android, just use a browser to access the phone, via port 8000

How to install phpmyadmin for mysql 8 in Centos 7

To install mysql 8 on centos 7, please follow here.

Install epel-release

# yum install -y epel-release

Install phpmyadmin, httpd and php

# yum install -y phpmyadmin httpd php 

Change the ip allowed to access phpmyadmin by changing 127.0.0.1 to your network's ip (in my case, I want to allow all machine with 192.168.0 ip to be able to access the phpmyadmin page)

# sed -i 's/127.0.0.1/192.168.0/g'  /etc/httpd/phpMyAdmin.conf

Start httpd

# systemctl start httpd

Allow http on firewall

# firewall-cmd --add-service http

# firewall-cmd --add-service http --permanent

Change your mysql user's password to use mysql_native_password

# mysql -u root -p

mysql> ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY 'MyNewPassword!123';

You should be able to access phpmyadmin, by pointing your browser to the server's ip address, followed by /phpmyadmin

And the you can login into phpmyadmin by supplying mysql username and password

Simple http server using nodejs http-server

This method is particularly useful if you want to make some files on your server, downloadable on the internet, via any port you choose, directly using your ip (or public ip)

Install epel repository
# yum install epel-release

Install npm
# yum install npm

Check whether npm (nodejs package manager) is installed
# npm -v

Install http-server globally
# npm install http-server -g

Start http-server on port 80, serving content in /tmp/test
# http-server /tmp/test -p 80

You should now able to browse to the ip address of the machine (in this example, 139.x.x.x) using a browser, and should be able to download the content of /tmp/test

Start a simple http server using python3

This is very simple, because python3 already has a built in module for http server, called http.server. To use this module, run:

$ python3 -m http.server 8000

whereby 8000 is the port you want the http server to run on. To use privileged ports (under 1024) , just append sudo to the above command, like below:

$ sudo python3 -m http.server 80

Once the command run, you can access the current directory via web, like below:



Once done, press Ctrl-c to terminate the server.

How to determine your proxy ip address and port using curl

This is very easy, what you have to do is use curl to access any site, and curl will let you know what is the proxy address if you have not put in your authentication details. See below example:

foobar@ubuntu-vm:~$ curl www.google.com -IL
HTTP/1.1 302 authenticationrequired
Date: Tue, 26 Jan 2016 06:46:15 GMT
Location: http://10.155.120.23:9090/mwg-internal/de5fs23hu73ds/plugin?target=Auth&reason=Auth&ClientID=2297288988&ttl=600&url=aHR0cDovL3d3dy5nb29nbGUuY29tLw==&rnd=1453790775
Connection: Keep-Alive
Content-Type: text/html
Cache-Control: no-cache

HTTP/1.1 401 authenticationrequired
Date: Tue, 26 Jan 2016 06:46:15 GMT
Connection: Keep-Alive
Content-Type: text/html
Cache-Control: no-cache
WWW-Authenticate: NTLM
WWW-Authenticate: Basic realm="MY COMPANY WEB GATEWAY"

You can see from above that my proxy ip address is 10.155.120.23, and my proxy port is 9090.

Simple http server using python

This tip is really useful when you need a really quick web server running without too much hassle. Python comes with http server built-in that you can activate in a matter of seconds if you have python already installed. If you haven't install it, you might need an additional few minutes to install it. Below are the steps (this is assuming you are using redhat/fedora linux):

1. open a terminal and install python

# yum install python

2. Once done, browse to any directory that you want to be your document root directory, in this example I'll use /home/myuser

# cd /home/myuser

3. Run the below command to start the simple http server, where 8000 is the port number the server will use

# python -m SimpleHTTPServer 8000
Serving HTTP on 0.0.0.0 port 8000 ...

4. Now open a browser, and type http://192.168.1.2:8000 to access the server, where 192.168.1.2 is your machine's ip address