Secure Apache Configuration

1. Config in httpd.conf

   
   

2. Hide the Apache Version number, and other sensitive information.

   ServerSignature Off
   ServerTokens Prod

   The ServerSignature appears on the bottom of pages generated by apache such as 404 pages, directory listings, etc.

   The ServerTokens directive is used to determine what Apache will put in the Server HTTP response header. By setting it toProd it sets the HTTP response header as follows:

   Server: Apache

3. Make sure apache is running under its own user account and group

   User apache
   Group apache

4. Ensure that files outside the web root are not served
   

   <Directory />
   	Order Deny,Allow
   	Deny from all
   	Options None
   	AllowOverride None
   </Directory>
   <Directory /web>
   	Order Allow,Deny
   	Allow from all
   </Directory>

5. Turn off directory browsing
   

   Options -Indexes

6. Turn off server side includes
   

   Options -Includes

7. Turn off CGI execution
   

   Options -ExecCGI

8. Don't allow apache to follow symbolic links
   

   Options -FollowSymLinks

9. Turning off multiple Options
   

   Turn off all Options:

   Options None

   Turn off some Options:

   Options -ExecCGI -FollowSymLinks -Indexes

10. Turn off support for .htaccess files
    

    AllowOverride None

11. Lower the Timeout value
    

    Timeout 45

12. Restricting Access by IP
    

    Order Deny,Allow
    Deny from all
    Allow from 127.0.0.1