Tag Archives: Best Practice

Apache: Reducing Information Leaked Through The Headers

Apache by default announces all sorts of information about itself when you make a connection to it :- $ lynx -head http://some-server-fqdn/ HTTP/1.1 302 Found Date: Thu, 31 May 2018 12:18:22 GMT Server: Apache/2.2.15 (CentOS) Location: https://t-oala-idp-01.iso.port.ac.uk/ Connection: close Content-Type: … Continue reading

Posted in Technical | Tagged , | Comments Off on Apache: Reducing Information Leaked Through The Headers

Apache: Disabling Directory Indexes

One of the features of Apache that can cause security issues (or at least those who audit security issues may complain about it) is the ability to produce a file listing of a directory if there is no index page … Continue reading

Posted in Technical | Tagged , | Comments Off on Apache: Disabling Directory Indexes

Apache: Disable the ETag Header

By default, the Apache web server has an information disclosure vulnerability where the ETag header shows information about the file containing the object in question. This can contain an “i-node” value which in combination with the use of NFS can permit … Continue reading

Posted in Technical | Tagged , | Comments Off on Apache: Disable the ETag Header

Apache: Disabling TRACK and TRACE Methods

By default Apache supports a number of HTTP methods in addition to the ones we normally use – GET (to get objects) and PUSH (to push form data although you can send form data with GET too). These additional methods … Continue reading

Posted in Technical | Tagged , | Comments Off on Apache: Disabling TRACK and TRACE Methods