ConfigTemplates/apache2file-000-default.conf at main · OsbornePro/ConfigTemplates · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
# OsbornePro LLC. Starting Template for the /etc/apache2/sites-enabled/000-default.conf file
# This is meant as a starting template to help secure apache
# The custom ports I defined are just to show they can be changed if needed and do not suggest the ports are more secure than the defaults
<VirtualHost *:8080 *:4443>

	# Rewrite engine will not work unless these are high up on your config file
	RewriteEngine  on
        # Block HTTP 0.9 and HTTP/1.0
        RewriteCond %{SERVER_PROTOCOL} ^HTTP0\.9$ [NC,OR]
        RewriteCond %{SERVER_PROTOCOL} ^HTTP/1\.0$ [NC]
        RewriteRule .* - [F]

        # Block TRACE TRACK and OPTIONS HTML type requests
        RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS)
        RewriteRule .* - [F]

        # Block Unwanted User Agents
        RewriteCond %{HTTP_USER_AGENT} python [NC,OR]
        RewriteCond %{HTTP_USER_AGENT} wfuzz [NC,OR]
        RewriteCond %{HTTP_USER_AGENT} go [NC,OR]
        RewriteCond %{HTTP_USER_AGENT} ^Fuzz\ Faster\ U\ Fool [NC,OR]
        RewriteCond %{HTTP_USER_AGENT} ^Mozilla/4\.0\ \(compatible [NC,OR]
        ReWriteCond %{HTTP_USER_AGENT} curl [NC]
        RewriteRule .* - [F]

        # Block unwanted Referers
        RewriteCond %{HTTP_REFERER} blowfish|CatchBot|BecomeBot [NC]
        RewriteRule .* - [F,L]
	ServerName You Server FQDN Here
	ServerAdmin admin@domain.com
	DocumentRoot /var/www/html

	# Forward HTTP to HTTPS
	Redirect / https://site.domain.com:4443/

	# Below header settings require ```sudo a2enmod headers``` headers module to be enabled
	# Or add to your httpd.conf file ```LoadModule headers_module /usr/lib/apache2/modules/mod_headers.so```
	# Use HSTS, protect cookies, XSS Protection
	Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains"
	Header always append X-Frame-Options SAMEORIGIN
	Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
	Header set X-XSS-Protection "1; mode=block"


	# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
	# error, crit, alert, emerg.
	# It is also possible to configure the loglevel for particular
	# modules, e.g.
	LogLevel info ssl:warn
	ErrorLog ${APACHE_LOG_DIR}/error.log
	CustomLog ${APACHE_LOG_DIR}/access.log combined

	# For most configuration files from conf-available/, which are
	# enabled or disabled at a global level, it is possible to
	# include a line for only one particular virtual host. For example the
	# following line enables the CGI configuration for this host only
	# after it has been globally disabled with "a2disconf".
	#Include conf-available/serve-cgi-bin.conf

    <Directory "/var/www/html">
	RewriteEngine  on
	RewriteRule    "^/$"  "uriextensionIfYouHaveOneToForwardToo"  [R]
    </Directory>

    <Files "custom_404.html">
        <If "-z %{ENV:REDIRECT_STATUS}">
            RedirectMatch 404 ^/custom_404.html$
        </If>
    </Files>

    <Files "custom_50x.html">
        <If "-z %{ENV:REDIRECT_STATUS}">
            RedirectMatch 404 ^/custom_50x.html$
        </If>
    </Files>
</VirtualHost>
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet