Hide Apache Httpd Version in HTTP Header

Hiding software version in any deployment is a basic security practice that we can use to lower the risk of the deployment being breached. In this post, we will see how we can hide the apache httpd version from the http header, and from server generated pages.

To check our header, just use curl. Let's say we have an apache httpd server running on localhost

$ curl --header http://localhost

The version will also showing in the server generated page, like when we tried to access non existent page

$ curl --header http://localhost/error

To hide the version number, we can just add below line into httpd.conf. I usually will put it at the bottom of the configuration file. The location of the httpd.conf will varies depending on how you install httpd. The usual location is at /etc/httpd/conf/httpd.conf:

ServerToken Prod

ServerSignature Off

"ServerToken Prod" will hide apache httpd version from http header, while "ServerSignature Off" will hide the version from server generated pages.

Example is like below

To make sure that our change is syntax error free, test with "apachectl -t"

Once we are satisfied, restart apache httpd

# systemctl restart httpd

Then, we test it back using curl, and we do not see the version anymore

$ curl --head http://localhost

$ curl --head http://localhost/error

Testing SSL Certs Using Apache on Docker

Sometimes we have a need to test our SSL, before we deploy it to production. If we have a development or staging environment, then we can test it there. But if we do not have that, we can always rely on trusty old docker to test the ssl in our own machine. Please follow along to learn how to do it.

Pre-requisite:

- have docker installed 

1. Put our ssl cert, intermediate cert (if we have one) and key into our current directory. Rename them as server.crt, server.key and server-ca.crt

2. Prepare a configuration file like below inside our current directory, and save it as https.conf

Listen 443

<VirtualHost _default_:443>

  DocumentRoot "/usr/local/apache2/htdocs"

  ServerName linuxwave.info

  ServerAdmin me@linuxwave.info

  ErrorLog /proc/self/fd/2

  TransferLog /proc/self/fd/1

  SSLEngine on

  SSLCertificateFile "/ssl/server.crt"

  SSLCertificateKeyFile "/ssl/server.key"

  SSLCertificateChainFile "/ssl/server-ca.crt"

</VirtualHost>

3. Run a container based on the httpd image from dockerhub, and mount the current folder with our ssl key and certs into /ssl in the container

docker run -dit --name apache -v ${PWD}:/ssl httpd

4. Copy /usr/local/apache2/conf into /ssl, so that we can edit it inside our host machine

docker exec -it apache cp /usr/local/apache2/conf/httpd.conf /ssl

5. Enable ssl in apache config by adding these lines into httpd.conf. We can just edit the file in our host machine, since text editor is not installed by default inside the apache image. The first 2 lines are to enable ssl support for apache, and the last line is for apache to include any files that end with .conf into its configuration

LoadModule ssl_module modules/mod_ssl.so

LoadModule socache_shmcb_module modules/mod_socache_shmcb.so

Include conf/extra/https.conf

6. Copy the edited httpd.conf file back into its original location

docker exec -it apache cp /ssl/httpd/conf /usr/local/apache2/conf

7. Create a symlink from /ssl/https.conf into /usr/local/apache2/conf/extra/

docker exec -it apache ln -s /ssl/https.conf /usr/local/apache2/conf/extra

8. Test the configuration file

docker exec -it apache httpd -t

9. If no error was found from the above command, restart the container

docker restart apache

10. Open a new terminal, and get the ip address of the container

docker inspect apache | grep IPAddress

11. Put the ip address and your hostname inside your machine's /etc/hosts

echo "172.17.0.2 linuxwave.info" | sudo tee -a /etc/hosts 

12. Try to access the above domain using a web browser, and check the ssl cert information

13. If the ssl certs are working fine inside docker, you can be sure that it will work just fine in your production server

Run an apache webserver with php using docker

This is actually very easy, just run below command to start it

docker run -d -p 8000:80 --mount type=bind,source"$(pwd):/htdocs",target=/var/www/html php:apache

The options are:

-d : run this container in a detached mode (in the background)

--mount : mount a folder in current directory called htdocs (will be created by docker) into /var/www/html in the container

-p 8000:80 : will map port 8000 in localhost to port 80 in the container

Once started, create a simple php script inside the htdocs directory

cd htdocs

cat >> index.php<<EOF
<?php

echo "This is my php script";

?>

EOF

And browse using a normal web browser to http://localhost:8000. You should see "This is my php script" shown in your web browser 

Create a local repository in CentOS 7 over http

What you need to create a local repository in centos 7 over http is a web server (httpd) and createrepo command. Let's assume the ip address of this server is 10.10.10.10.

# yum install httpd createrepo yum-utils -y

Then, create a directory to store the repository files

# mkdir /var/www/html/repos

Create XML based rpm meta-structure repository, like an index file that points to rpm files for our repository

# createrepo /var/www/html

Configure httpd to allow followsymlinks 

# diff -u /etc/httpd/conf/httpd.conf.ori /etc/httpd/conf/httpd.conf

--- httpd.conf.ori      2021-12-06 12:23:36.704096479 +0800

+++ httpd.conf  2021-12-06 12:21:37.423092872 +0800

@@ -141,7 +141,8 @@

     # http://httpd.apache.org/docs/2.4/mod/core.html#options

     # for more information.

     #

-    Options Indexes FollowSymLinks

+    #Options Indexes FollowSymLinks

+    Options All Indexes FollowSymLinks

 

     #

     # AllowOverride controls what directives may be placed in .htaccess files.

Check for any error

# httpd -t

Restart httpd

# systemctl restart httpd

Sync files from the official repo

# yum install yum-utils

# reposync -g -l -d -m --repoid=base --newest-only --download-metadata --download_path=/var/www/html/repos/ 

Allow port 80 in firewall

# firewall-cmd --add-service http

# firewall-cmd --add-service http --permanent

Create a yum repo configuration file

# cat >> /etc/yum.repos.d/local.repo <<EOF

[local]

name=CentOS Apache

baseurl=http://10.10.10.10

enabled=1

gpgcheck=0

EOF

Test repo. You should be able to see the local repository being listed. Run a yum search command to see whether yum is able to get package info from the local repo.

# yum repolist

Hiding Apache2 (httpd) Version in HTTP Header

One of the basic concept of cybersecurity, is to hide as much information about your system from the public view. For apache2 (httpd), this is pretty easy to do.

1. First, open /etc/httpd/conf/httpd.conf

$ sudo vi /etc/httpd/conf/httpd.conf

2. Then, append below lines to the file

...

ServerTokens Prod

ServerSignature Off

3. Save the file

4. Test the configuration, to make sure no typo error that can cause httpd to fail to start

$ sudo httpd -t

5. Restart httpd to activate the settings

$ sudo systemctl restart httpd

6. Finally, you can verify the visibility of the webserver's version number using curl or wget 

$ curl --head http://www.mydomainname.com

...

Server: Apache

... 

 

How to Redirect HTTP Traffic to HTTPS in httpd on CentOS

The easiest way is to do it using the VirtualHost configuration, if you have control over it. 

Edit your virtualhost configuration for that domain, in CentOS it is usually located in /etc/httpd/conf.d/mydomain.conf:

<VirtualHost *:80>

   ServerName www.mydomain.com

   Redirect / https://www.mydomain.com

</VirtualHost>

<VirtualHost _default_:443>

   ServerName www.mydomain.com

   DocumentRoot /usr/local/apache2/htdocs

   SSLEngine On

...

</VirtualHost>

The most important line is the "Redirect" line which will redirect all http traffic to https.

Once done, save the file.

Do not forget to run syntax test of the configuration files.

# httpd -t

And reload the service

# systemctl reload httpd

Installing Joomla 3.9.6 on Centos 7 with httpd, php 7.3 and mysql 8.0

MYSQL

Install mysql 8.0 repository
# rpm -Uvh https://repo.mysql.com/mysql80-community-release-el7-3.noarch.rpm

Install mysql-server 8.0
# yum install -y mysql-community-server

Start mysql server
# systemctl start mysqld

Secure mysql server installation, answer yes to all question in the mysql_secure_installation procedure
# grep password /var/log/mysql.log
# mysql_secure_installation

Change mysql default authentication plugin to mysql_native_password. Refer here for more information
# cat >> /etc/my.cnf <<EOF
[mysqld]
default-authentication-plugin=mysql_native_password

EOF

Restart mysql

# systemctl restart mysqld

Create database for joomla

# mysql -u root -p

mysql> create database joomla;

mysql> create user joomla@localhost identified by 'MyJoomla123!';

mysql> grant all privileges on joomla.* to joomla@localhost;

PHP

Install epel and remi repository

# yum install epel-release -y

# rpm -Uvh https://rpms.remirepo.net/enterprise/remi-release-7.rpm

Install php73 and required components

# yum --enablerepo=remi-php73 install php php-zlib php-xml php-json php-mcrypt php-mysqlnd -y

HTTPD

Install httpd server

# yum install -y httpd

Start httpd

# systemctl start httpd

JOOMLA

Download joomla source code

# yum install -y wget

# wget https://downloads.joomla.org/cms/joomla3/3-9-6/Joomla_3-9-6-Stable-Full_Package.tar.gz

Create a directory for joomla in httpd's root directory

# mkdir /var/www/html/joomla

Extract the code into the directory in root directory

# tar -xvf Joomla_3-9-6-Stable-Full_Package.tar.gz -C /var/www/html/joomla

Give proper owner to joomla directory

# chown -R apache.apache /var/www/html/joomla

Restart httpd

# systemctl restart httpd

Browse to http://your.ip.add.ress/joomla, to access the installation wizard. Fill in your site's preferences, and click Next

Fill in database details, as per MYSQL section above, and click Next

Fill in ftp configurations, if applicable, and click Next

Click Install

Joomla is now installed

Copy the code in Notice, and paste it in a new file called /var/www/html/joomla/configuration.php

Remove the installation older

# rm -rf /var/www/html/joomla/installation

Click on Site button to view your joomla main page, and click on Administrator button to view your joomla administrator's site.

How to hide web server version from appearing in http header

For apache, just add below lines into /etc/apache2/apache2.conf:

ServerTokens Prod

ServerSignature Off

where ServerTokens controls what kind of information being sent to the header. Options available for ServerTokens are(from apache docs):

ServerTokens Prod[uctOnly]

Server sends (e.g.): Server: Apache

ServerTokens Major

Server sends (e.g.): Server: Apache/2

ServerTokens Minor

Server sends (e.g.): Server: Apache/2.0

ServerTokens Min[imal]

Server sends (e.g.): Server: Apache/2.0.41

ServerTokens OS

Server sends (e.g.): Server: Apache/2.0.41 (Unix)

ServerTokens Full (or not specified)

Server sends (e.g.): Server: Apache/2.0.41 (Unix) PHP/4.2.2 MyMod/1.2



while ServerSignature is to allow configuration of a trailing footer line under server generated documents, such as error messages and mod_proxy ftp directory listings. Putting it to off will suppress the footer line.

Once added, restart or reload apache to activate the changes.

# /etc/init.d/apache2 restart

For nginx, add below line into your /etc/nginx/nginx.conf:

server_tokens off

where this line of config will hide your nginx version number. Do not forget to restart or reload nginx, for the change to take effect.

# /etc/init.t/nginx restart

To check for the header, you can use curl:

curl -I www.foo.net

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Server: Apache/2.2.15 (Red Hat)

where -I is for curl to grab just the http header.