3

I just found requests like this in my access log:

180.76.15.134 - - [30/Oct/2017:22:38:05 +0100] "GET /manual/en/server-wide.html HTTP/1.1" 200 3551 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"

Accessing this path surprised me: my server (Ubuntu 16.04 / Apache 2.4 / Virtualmin, hardened by various guides i.e. to not expose it's OS or the version of the webserver) responded with the Apache manual that exposed at least it's version.

Now of course there's no directory manual. But I also couln't find a directive or so. Googling around did not give me an answer.

Does someone know where this comes from and how to disable it? Of course I could try to declare a <LocationMatch>-directive, but I want to know where it comes from and whether it's possible to supress this the right way. Who knows what else is going on there...

Improve this question
2
  • 2
    Look into your Apache config. There is most likely a config stanza included somewhere that points to the Apache manual.
    – Sven
    Oct 31, 2017 at 11:14
  • 2
    On the other hand: This is really not critical despite of what some "hardening guides" tell you because attacks are mostly automatic and test everything possible and they don't care if your web server advertises its version or not.
    – Sven
    Oct 31, 2017 at 11:19

3 Answers 3

Reset to default
8

It is considered good practice to not install OS components and software packages that are not necessary.

The apache httpd manual is as far as I know not installed by default but an optional package, that as such can easily be removed and/or disabled.

You probably installed the documentation package apache2-doc which installs a drop-in configuration file /etc/apache2/conf-available/apache2-doc.conf that serves content from /usr/share/doc/apache2-doc/manual

Either remove the package apache2-doc or disable configuration drop-in with a2disconf apache2-doc (and restart your webserver).

Improve this answer
2

On Centos, the package httpd-manual provides the manual. You could just remove that package, or comment out everything in /etc/httpd/conf.d/manual.conf

Improve this answer
0

I consider that's a good question today, because google bot and other search algorithms cached those Apache pages everyday, and other web users find those html pages. So, I did change rules in the apache2-doc.conf file that grant local access only to network IP addresses as it follows:

<Directory "/usr/share/doc/apache2-doc/manual/">
    Options Indexes FollowSymlinks
    AllowOverride All
    <IfModule mod_authz_core.c>
      <RequireAny>
        Require ip 127.0.0.1
        Require ip ::1
        Require ip x.x.x.0/24
      </RequireAny>
    </IfModule>
    AddDefaultCharset off
</Directory>
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .