Web server hardening & HTTPS

Your website is the one door you want everyone to walk through. That makes it the part of the server strangers look at most. Out of the box, Apache is friendly: it tells visitors its version, lists folders that have no index page, and talks in plain text anyone on the network can read. Let's make it polite but tight-lipped, and encrypted.

Where the config lives

You set up Apache in Linux Basics, lesson 14. The two families split its config up differently:

Say less: version numbers and folder listings

Ask your own server what it tells visitors: curl -I http://localhost. The Server: line shows Apache's exact version, and often the OS. Like the nmap -sV result in lesson 4, that saves an attacker a step. Two settings fix it:

ServerTokens Prod        # Server: header just says "Apache"
ServerSignature Off      # no version line at the bottom of error pages

Next, folder listings. Both families ship Options Indexes for the web folder. That means a folder with no index.html shows a list of every file in it, including ones you never linked to. Take Indexes out of the Options line and Apache answers "403 Forbidden" instead.

Security headers

Headers are little notes your server sends with every page, telling the browser how to behave. A few cost nothing and block whole kinds of attacks:

They're set with Header always set NAME "value". On Rocky, mod_headers is already on. On Ubuntu, turn it on first with sudo a2enmod headers, or the config check fails with "Invalid command 'Header'".

HTTPS

Without HTTPS, everything between the browser and your server (passwords, form data, cookies) travels as plain text. HTTPS encrypts it and proves the visitor is talking to the real server. That proof is a certificate.

A self-signed certificate encrypts just as well, but nobody vouches for it, so browsers warn and curl refuses unless you add -k. That's fine for a lab. Let's Encrypt gives real, trusted certificates for free, but it has to reach your server by its domain name from the internet, which a home lab can't do. Use certbot when your site has a real name.

Once HTTPS works, send plain-HTTP visitors over to it with a redirect in the port-80 site:

<VirtualHost *:80>
    Redirect permanent / https://192.168.1.50/
</VirtualHost>

Try it: lock up the club website 🔐

The club site runs on the server with the factory settings. Work through it the way you would on a real server: look, change one thing, test, reload.

Quick check