Web server hardening with nginx and Apache
You close what the web server in front of the app leaks, fix the typical traps in nginx and Apache configuration, and manage hardening as code verified by tests.
Level 201 · 17 lessons · 15 practice labs
Lessons
Foundations
- The web server’s roles: static content, reverse proxy and TLS termination
- Hiding version information and default pages
- Running worker processes as an unprivileged user
- Turning off directory listing and access to hidden files
- Short task: find and close what the lab server leaks
nginx
- nginx configuration structure: http, server and location
- location and alias pitfalls: a door to path traversal
- Request size, timeouts and rate limits (limit_req)
- Headers behind a reverse proxy: how far to trust X-Forwarded-For
- Short task: fix three mistakes in an nginx config and verify with gixy
Apache
- Apache modules: switching off what you do not need
- .htaccess and AllowOverride risks
- Request limits and mod_reqtimeout in Apache
- Short task: harden an Apache virtual host against CIS recommendations
Verifying
- Managing configuration as code and reviewing changes
- Verifying hardening with scans and tests
- Capstone: harden the nginx and Apache servers in front of an app and write a report
Practice labs
- The Server header and the default page: Turn off nginx's version-leaking Server header and default welcome page and confirm with curl.
- Directory listing left on: Find a path with directory listing on, turn listing off and show the folder contents are no longer visible.
- The process runs as root: Show the app server runs as root, move it to a separate service user and adjust file permissions to match.
- Access to hidden files: .htpasswd and backups: Find that dotfiles and backup extensions are served and write and test one rule that blocks them all.
- The alias trap: /static../: Prove a location without a trailing slash paired with alias gives access to the parent folder and fix the configuration.
- Limiting the login page with limit_req: Define a limit_req zone for the login path, tune the burst value and test that legitimate use is not affected.
- Blind trust in X-Forwarded-For: Prove the app takes the client IP from a forged X-Forwarded-For header and bind the real_ip settings to the trusted proxy only.
- Request size and timeouts: Fix a configuration open to slow-request attacks because of unlimited body size and long timeouts and test the new limits.
- Close the gixy findings: Scan the lab nginx configuration with gixy, fix the three issues it reports and prove each fix with a request.
- Disable needless Apache modules: List the loaded Apache modules, disable those the app does not use and confirm the site still works.
- The door opened by AllowOverride All: Show the configuration can be changed with .htaccess in the upload folder, turn AllowOverride off and move the rules to the main config.
- mod_reqtimeout and CIS recommendations: Harden a virtual host with request timeouts and CIS recommendations and prove each change with a short test.
- Review a configuration change: Find the risky line in a server configuration pull request and write a review comment with your reasons.
- Write hardening tests: Write automated tests that check headers, listings and hidden files and make them run in CI.
- Two servers, one report: Quillon Education: Harden the fictional Quillon Education's nginx and Apache servers, verify with tests and write a short report with a before-and-after table.
About this course
You close what the web server in front of the app leaks, fix the typical traps in nginx and Apache configuration, and manage hardening as code verified by tests.
What you will learn
- Foundations
- nginx
- Apache
- Verifying
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.