public_git
/
ansibleguy.infra_apache
mirror of https://github.com/ansibleguy/infra_apache.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

added denial of TRACE and CONNECT methods

This commit is contained in:
AnsibleGuy 2023-08-25 19:27:14 +02:00
parent 48117e4d3f
commit ff4f498d2b
No known key found for this signature in database
GPG Key ID: 52984C069F5AD3CD
3 changed files with 17 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
defaults/main/1_main.yml
View File

@ -91,5 +91,6 @@ defaults_apache:
security: security:
restricted_methods: ['GET', 'POST', 'HEAD'] restricted_methods: ['GET', 'POST', 'HEAD']
dangerous_methods: ['TRACE', 'CONNECT']
debug: false debug: false

3
defaults/main/2_site.yml
View File

@ -26,7 +26,8 @@ defaults_site:
security: # https://www.nixpal.com/apache-httpd-hardening/ security: # https://www.nixpal.com/apache-httpd-hardening/
disable_root_index: true disable_root_index: true
disable_ssi_cgi: true disable_ssi_cgi: true
restrict_methods: true restrict_methods: true # disable anything but GET/POST/HEAD methods; if you're running a web-application you might need to disable this filter
deny_dangerous_methods: true # if 'restrict_methods' is disabled - this will still deny 'TRACE' & 'CONNECT' as they might open your server/services up to attacks
redirect: redirect:
target: 'https://github.com/ansibleguy' target: 'https://github.com/ansibleguy'

17
templates/etc/apache2/sites-available/inc/site_https_config.j2
View File

@ -18,15 +18,26 @@
{% endif %} {% endif %}
# security config # security config
{% if site.security.restrict_methods %} {% if site.security.restrict_methods | bool %}
<IfModule mod_rewrite.c> <IfModule mod_rewrite.c>
RewriteEngine On RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^(?!{% for method in APACHE_CONFIG.security.restricted_methods %}{{ method }}{% if not loop.last %}|{% endif %}{% endfor %}) RewriteCond %{REQUEST_METHOD} ^(?!{{ for method in APACHE_CONFIG.security.restricted_methods | join('|') }})
RewriteRule .* - [F] RewriteRule .* - [L,R=405]
</IfModule> </IfModule>
<Directory /> <Directory />
<LimitExcept {% for method in APACHE_CONFIG.security.restricted_methods %}{{ method }} {% endfor %}> <LimitExcept {% for method in APACHE_CONFIG.security.restricted_methods %}{{ method }} {% endfor %}>
Require all denied Require all denied
</LimitExcept> </LimitExcept>
</Directory> </Directory>
{% elif site.security.deny_dangerous_methods | bool %}
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^({{ for method in APACHE_CONFIG.security.dangerous_methods | join('|') }})
RewriteRule .* - [L,R=405]
</IfModule>
<Directory />
<Limit {% for method in APACHE_CONFIG.security.dangerous_methods %}{{ method }} {% endfor %}>
Require all denied
</Limit>
</Directory>
{% endif %} {% endif %}