Web servers: Nginx and Apache
Installation, virtual hosts, TLS and configuration.
Level 301 · 17 lessons · 15 practice labs
Lessons
Nginx
- Installing Nginx and managing it as a service: You will install Nginx, start and stop it as a service, and confirm that the default page works.
- Nginx: virtual hosts: You will learn to serve several separate sites from one Nginx server using virtual host settings.
- Nginx: reverse proxy and location: You will learn to place Nginx in front of an application as a reverse proxy and use location blocks to decide where requests go.
- Nginx: basic authentication and error pages: You will learn to protect a page with basic authentication in Nginx and to prepare custom error pages that do not leak details.
- Nginx logs: access format and error levels
- Static files, compression and browser caching
- Short task: put a second site live on the same server
Apache
- Installing Apache and the document root: You will install Apache, find the document root (the folder holding the site's files), and publish your first page.
- Apache: name-based virtual hosts: You will define name-based virtual hosts in Apache so that one machine can serve several sites.
- Apache: .htaccess and rewriting: You will understand Apache's .htaccess file for per-folder settings and its URL rewrite rules, and why they must be used carefully.
- Turning Apache modules on and off: a2enmod and conf.d
- Short task: move old URLs to new pages with permanent redirects
Operations and security
- Validating and reloading Nginx and Apache configuration: You will learn to check a configuration change for syntax errors before applying it, and to reload it without interrupting the service.
- Installing and renewing a TLS certificate
- Ownership of web files and the service user
- Hardening a web server with Nginx and Apache: You will learn basic web server hardening steps such as hiding version information, disabling unneeded modules and adding security headers.
- Capstone: a secure Nginx web server hosting two sites: For a fictional company you will build a hardened web server with a validated configuration that serves two separate sites.
Practice labs
- Publish a second site in Nginx: Create a server block and root directory for a new domain and verify both sites return the right content.
- Fix a location block that matches wrongly: Fix the location order and match type that sends static files to the application.
- Put an application behind a reverse proxy: Put an app on a local port behind Nginx, pass the real client address and original host headers and set the timeouts.
- Set up a name-based virtual host in Apache: Define and enable separate virtual hosts for two domains and pass the configuration test.
- Move directory-level settings into the main config: Move redirect and access rules from .htaccess into the virtual host and turn off directory-level overrides.
- Turn off unneeded Apache modules: List loaded modules, disable those the site does not use and show by testing that every page still works.
- Open a site to HTTPS with a lab certificate: Install a certificate from the lab authority on the site and redirect HTTP requests to HTTPS.
- Turn off old protocols and weak ciphers: Scan the protocols and cipher suites the server offers, disable the old versions and verify by scanning again.
- Complete a missing certificate chain and add HSTS: Add the intermediate certificate to a site that fails trust on some clients, define HSTS and automate the reload after renewal.
- Extract the most requested pages from the access log: From the access log find the five most requested paths and the number of requests returning 404.
- Find the cause of a 502 error: Identify the upstream connection problem from the error log and bring the site back by fixing the socket path and permission.
- Apply a config change without downtime and reversibly: Write a deploy script that tests the change, reverts to the old file on failure and reloads without dropping connections.
- Hide the server version: Stop the version from showing in response headers and error pages on Nginx and Apache.
- Add security headers and turn off directory listing: Add framing, content type and referrer headers and block directory listing and access to hidden files.
- Audit a web server against a hardening list: Audit Mavikaya Lojistik's web server against a twelve-item list, fix the gaps, add a rate limit and prepare a before and after table.
About this course
Installation, virtual hosts, TLS and configuration.
What you will learn
- Nginx
- Apache
- Operations and security
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.