Hardening webserver

Unlike other devices sitting behind layers of defenses and firewalls, web servers sit at the edge of the known network and are designed to share information with the outside, the unknown. These are some notes on hardening the two most used web servers, Nginx and Apache.

Building a sound foundation

• Introduction
• Keep only required modules
• Disable unwanted services
• Restrict file and directory access
• Disable unwanted HTTP methods
• Create non-root users
• Install and use ModSecurity
• Install and use ModEvasive
• Set up and configure logging

Resolving TLS issues

• Introduction
• (Re)configure TLS
• Manually specify cipher suite
• Configure forward secrecy

Preventing information disclosure

• Introduction
• Hide web server information
• Disable directory listing

Setting HTTP security headers

• Introduction
• Check your HTTP security headers
• HTTP Strict Transport Security (HSTS)
• X-Frame-Options
• Content Security Policy (CSP)
• Permissions-Policy
• Referrer-Policy
• X-Content-Type-Options
• X-XSS-Protection
• Set-Cookie
• Content-Type

Using CORS

• Introduction
• CORS best practices
• CORS on Nginx
• CORS on Apache