httpdのconfをより安全に

close welcome page

cd /etc/httpd/conf.d/
sudo mv welcome.conf welcome.conf.org

iconsフォルダ無効化

cd /etc/httpd/conf.d/
sudo mv autoindex.conf autoindex.conf.org
#check if error
sudo httpd -t
sudo systemctl restart httpd
#confrim http://サイトのURL/icons/README changed to be not found

TLS1.0 と TLS1.1 を無効にし、TLS1.2 のみ利用する設定

#confirm  ciphers
openssl ciphers -v

sudo emacs /etc/httpd/conf.d/ssl.conf
---
#edit as below
#SSLProtocol all -SSLv2
#SLProtocol -all +TLSv1.3 +TLSv1.2
SSLProtocol -all +TLSv1.2

#SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!SEED:!IDEA
SSLCipherSuite HIGH:MEDIUM:!aNULL:eNULL:!MD5:!SEED:!IDEA:!3DES:!RC4:!ADH:!DH
#SSLCipherSuite TLSv1.3 TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-CHACHA20-POLY1305

#Perfect Forward Security
SSLSessionTickets off

SSLHonorCipherOrder on 

#turnoff compression
SSLCompression off
---

#restart sshd
sudo systemctl restart sshd

Apache 環境変数を変更

emacs /etc/sysconfig/httpd
---
export OPEN_NO_DEFAULT_ZLIB=1
---

ディレクトリ内容一覧表示off、バージョン表示offなど

sudo emacs /etc/httpd/conf/httpd.conf
---
# modified_as bellow
# index off
# Options Indexes FollowSymLinks
Options FollowSymLinks
# Apacheバージョン表示の無効化
ServerTokens ProductOnly
ServerSignature off
#HTTP TRACE of
TraceEnable off
#X-Frame-Optionsヘッダ
Header append X-FRAME-OPTIONS "SAMEORIGIN"

#set 404
ErrorDocument 404 /missing.html

---
#restart httpd
sudo systemctl restart httpd