0

When setting up an instance of Apache httpd (2.4) on RHEL 9, I add the following as drop-in configuration file (/etc/httpd/conf.d/12-secure.conf) in an attempt to increase security. I would also like to include a redirect of http to https in this file without the need to edit the server name (sample below). Ideally, this would allow me to place the file on any server without the need for modification. Is this possible or am I managing/thinking incorrectly?

# 12-secure.conf

# Remove version and OS from banner
ServerTokens Prod
ServerSignature Off

# Disable Etag support
FileETag None

# Disable TRACE HTTP method
TraceEnable off

# Mitigate click-jacking
Header always append X-Frame-Options SAMEORIGIN

# Mitigate XSS
Header set X-XSS-Protection "1; mode=block"

# Disable HTTP 1.0
RewriteEngine On
RewriteCond %{THE_REQUEST} !HTTP/1.1$
RewriteRule .* - [F]

# Prevent Slow-Loris (DoS timeout attack)
Timeout 60

Redirect from httpd.conf

# Code snippet from /etc/httpd/conf/httpd.conf

# Force https
<VirtualHost *:80>
        DocumentRoot "/var/www/html"
        ServerName sub.domain.com
        Redirect permanent "/" "https://sub.domain.com"
</VirtualHost>

Feel free to offer other, general advice on the 12-secure.conf file as well.

6
  • @GeraldSchneider, I ran into that particular post previously. However, I was initially deterred from pursuing that solution due to Apache's suggestions on avoiding mod_rewrite for this purpose. However, I was able to use the solution in the drop-in file and it works without issue and simplifies things for me. If there is no reason to avoid mod_rewrite in this circumstance, then I'll call this solved. Thanks
    – JG7
    Sep 20, 2022 at 15:32
  • You can also use the suggested Redirect directive. It supports variables as well. Sep 20, 2022 at 19:56
  • I was not aware that variables would work in a VirtualHost directive. I am unsure how to execute that plan though--do you know of any reference material that I can look over? My searching has been mostly fruitless.
    – JG7
    Sep 21, 2022 at 13:22
  • 1
    Hm. Looks like I was mistaken, sorry about that. The Rewrite module seems like the way to go. Sep 21, 2022 at 13:35
  • to prevent slow-loris you use mod_reqtimeout , not a low default timeout, you need to specify shorter times and thresholds for headers, body, etc... default option with mod_reqtimeout are good enough for most cases, so just load the module. I would also not use that rewrite you are also excluding http/2. Disabling Etag is also a big mistake I believe since it helps browsers to cache static content. Some of the options you use seem like bad cases of copy paste, this is a broad subject. Sep 22, 2022 at 11:50

1 Answer 1

0

Per Gerald Schneider's comment, I have used mod_rewrite to force HTTPS in the drop-in file. Here is the final configuration, note the bottom portion as the addition. I have opted to leave the redundant command RewriteEngine On to help modularize for other admins.

# Remove version and OS from banner
ServerTokens Prod
ServerSignature Off

# Disable Etag support
FileETag None

# Disable TRACE HTTP method
TraceEnable off

# Mitigate click-jacking
Header always append X-Frame-Options SAMEORIGIN

# Mitigate XSS
Header set X-XSS-Protection "1; mode=block"

# Disable HTTP 1.0
RewriteEngine On
RewriteCond %{THE_REQUEST} !HTTP/1.1$
RewriteRule .* - [F]

# Prevent Slow-Loris (DoS timeout attack)
Timeout 60

# Force HTTPS
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

Not the answer you're looking for? Browse other questions tagged .