Tag: Centos

Apache Disable Directory Index

Enabling Apache Directory Index exposes a security vulnerability wherein accessing a URL lacking an index file reveals a directory listing of all files within. This presents a risk as it allows hackers to view the entire directory structure, compromising security. To prevent directory listings from being displayed, you can employ a couple of methods. One approach is to generate a file named either index.html or index.php, depending on the file name specified in the Apache DirectoryIndex directive, and leave it empty. Alternatively, you can disable directory indexing for the website within the Apache virtual host configuration. To do this, within the virtual host configuration file,

Options -Indexes

Here is an example apache configuration file

<VirtualHost *:80>
ServerName fleetfoundation.com
ServerAlias www.fleetfoundation.com
ServerAdmin example@fleetfoundation.com
DocumentRoot /home/fleetfoundation.com/html
CustomLog ${APACHE_LOG_DIR}/fleetfoundation.com.log combined
ErrorLog ${APACHE_LOG_DIR}/fleetfoundation.com-error.log
<Directory "/home/fleetfoundation.com/html">
Options All -Indexes
AllowOverride All
Require all granted
Order allow,deny
allow from all
</Directory>
</VirtualHost>

Method 2:

a2dismod autoindex -f
systemctl restart apache2

https://fleetfoundation.com/2024/02/25/apache-disable-directory-index/

How to configure Security Headers in Apache – Quick Sheet

Enable HSTS
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"


Enable X-Frame-Options
Header always append X-Frame-Options SAMEORIGIN


Enable X-XSS-Protection
Header set X-XSS-Protection "1; mode=block"


Enable X-Content-Type-Options
Header always set X-Content-Type-Options "nosniff"


Enable Referrer-Policy
Header always set Referrer-Policy "strict-origin"


Enable Content Security Policy (CSP)
Header always set Content-Security-Policy "default-src 'self'; font-src*;img-src * data:; script-src *; style-src *;"


Enable Permissions-Policy
Header always set Permissions-Policy "geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()"

https://fleetfoundation.com/2024/02/25/how-to-configure-security-headers-in-apache-quick-sheet/