For Teachers · Back to the Module · Print with your browser's Print command.

P18 Worksheet: Web Server Hardening: nginx and Apache

Student Worksheet (about 30 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: P4, P5

Learning Objectives

• [ ] Find the effective value of a directive across nginx.conf, conf.d, sites-enabled and Apache's Include tree.
• [ ] Explain why banner hiding, directory listing and TRACE are low-cost fixes worth making.
• [ ] Apply the Mozilla intermediate TLS profile and OCSP stapling to both servers.
• [ ] Deny dot-prefixed paths so repository and environment files are never served.

Key Terms

Write each definition in your own words.

• Cipher Suite: ______________________________________________
• OCSP Stapling: ______________________________________________
• Directory Listing: ______________________________________________
• Web Application Firewall: ______________________________________________
• TLS: ______________________________________________
• Fingerprinting: ______________________________________________

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only WEB-NGX-,WEB-APA- --out p15 and, for each finding, write the exact line in nginx.conf or apache2.conf that fixes it.
2. Compare /etc/nginx/nginx.conf and /etc/apache2/apache2.conf between the two labs (internal/lab/fixtures_servers_db_mail.go) and explain what each changed directive prevents.
3. On a test machine: nginx -T | grep -nE 'server_tokens|ssl_protocols|autoindex' and apachectl -t -D DUMP_CONFIG | grep -nE 'ServerTokens|SSLProtocol|Options' ; find the effective value and the file it came from.
4. Generate an intermediate profile for your server version at the Mozilla SSL Configuration Generator and list every directive it sets that your current configuration lacks.

Self-Check Questions

1. Apache has SSLEngine on but no SSLProtocol line. Which versions does it accept?

• [ ] a) TLS 1.2 and 1.3 only
• [ ] b) Everything except SSLv3, so TLS 1.0 and 1.1 too
• [ ] c) TLS 1.3 only
• [ ] d) TLS 1.0 only

1. Why does the Mozilla intermediate profile set ssl_prefer_server_ciphers off?

• [ ] a) It is faster for the server
• [ ] b) Every suite in the list is strong, so the client may pick the one its hardware handles best
• [ ] c) nginx requires it
• [ ] d) It turns off TLS 1.3

1. What does AllowOverride All let a .htaccess file do?

• [ ] a) Nothing beyond redirects
• [ ] b) Change handlers, options and access rules for that folder
• [ ] c) Change the server's TLS certificate
• [ ] d) Edit the main apache2.conf file

1. Which single rule stops nginx serving .git, .env and .svn under any site?

• [ ] a) autoindex off
• [ ] b) location ~ /\. { deny all; }
• [ ] c) server_tokens off
• [ ] d) client_max_body_size 1m

1. What does OCSP stapling do?

• [ ] a) Lets the server attach a fresh revocation status to the TLS handshake
• [ ] b) Encrypts the certificate's private key
• [ ] c) Turns off TLS 1.0
• [ ] d) Hides the server banner

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• Mozilla, Server Side TLS guidelines: https://wiki.mozilla.org/Security/Server_Side_TLS
• Mozilla SSL Configuration Generator: https://ssl-config.mozilla.org/
• Apache HTTP Server, Security Tips: https://httpd.apache.org/docs/2.4/misc/security_tips.html
• nginx documentation, ngx_http_ssl_module: https://nginx.org/en/docs/http/ngx_http_ssl_module.html
• NIST SP 800-52 Rev. 2, Guidelines for TLS Implementations: https://csrc.nist.gov/pubs/sp/800/52/r2/final
• OWASP Web Security Testing Guide, Configuration and Deployment Management Testing: https://wstg.owasp.org/v4.2/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.