Harden Apache2 Server’s Security (Ubuntu 16.04 LTS)

In previous guide, we written how to get started with a blank server, configure Apache for HSTS and how to configure IPTables. This guide is applicable for cloud, dedicated & virtual dedicated server. Here is a detailed guide on how to harden Apache2 server’s security on Ubuntu 16.04 LTS.

Harden Apache2 Server’s Security (Ubuntu 16.04 LTS)

The default settings file of Apache is located at :

And Apache2 security file located at :

We can test configuration by running :

Restart Apache2 webserver by :

Open :

Find these verbs and change then like written below, if some entry not present, add it :

It will take some time to find the settings and modify. Save the file. Run apachectl -t and run :

Why we did the above changes? To hide Apache Version and operating system identity which are available from error pages like 404. When we get 404, the web page displays the version of Apache web server installed on your server with the name of operating system name. Sometimes the information about Apache modules also become obvious. The above changes will not show up the informations.

Second part is installing and activating two modules – mod_security and mod_evasive. Of course you need to know the way to check which Apache modules are enabled. This is possible by running this command when Apache is running :

Or :

When Apache is not running. There are other ways like creating a PHP info file or a PHP file with the content :

and loading on browser. There is a separate Apache module named mov_info, which is not enabled by default for security. We need not to enable that module. Run a search on apt :

You’ll get the information :

You can install with :

This is the homepage of that module :

Read documents later. There is a supplied sample file :

Simply rename the file :

Create the blank log file :

After some time, run cat :

Web software like WordPress needs to have plugin or settings correct for this module. You’ll also get logs of the intrusions stopped by WordPress plugin IP Geo block. You should check the manual, the common config for virtual host is like this :

The module mod_evasive is for preventing DDoS. We can install by :

If you installed Apache in our way, mod_evasive will be active by default. If you run :

The configuration file is here :

Making the settings like this will work fine :

Create the directories and give permission :

Open :

Near end of file add these to whitelist own server :

Restart Apache :

This blog is official website of the above module :

Now, if PHP is running, then open PHP file :

Make sure the directives are present and like this :

Restart Apache :

We can set directory browsing off from virtual hosts with Options -Indexes like settings :

And from Apache main config file :

However, it is not recommended to override Apache’s default behaviour from Apache’s main config file, instead adding and empty index.html or index.php in the directories is another way.