When setting up an instance of Apache httpd (2.4) on RHEL 9, I add the following as drop-in configuration file (/etc/httpd/conf.d/12-secure.conf
) in an attempt to increase security. I would also like to include a redirect of http to https in this file without the need to edit the server name (sample below). Ideally, this would allow me to place the file on any server without the need for modification. Is this possible or am I managing/thinking incorrectly?
# 12-secure.conf
# Remove version and OS from banner
ServerTokens Prod
ServerSignature Off
# Disable Etag support
FileETag None
# Disable TRACE HTTP method
TraceEnable off
# Mitigate click-jacking
Header always append X-Frame-Options SAMEORIGIN
# Mitigate XSS
Header set X-XSS-Protection "1; mode=block"
# Disable HTTP 1.0
RewriteEngine On
RewriteCond %{THE_REQUEST} !HTTP/1.1$
RewriteRule .* - [F]
# Prevent Slow-Loris (DoS timeout attack)
Timeout 60
Redirect from httpd.conf
# Code snippet from /etc/httpd/conf/httpd.conf
# Force https
<VirtualHost *:80>
DocumentRoot "/var/www/html"
ServerName sub.domain.com
Redirect permanent "/" "https://sub.domain.com"
</VirtualHost>
Feel free to offer other, general advice on the 12-secure.conf
file as well.
Redirect
directive. It supports variables as well.