Apache 、PHP 安全性設定

最近因為基隆教育網路虛擬主機上放程式，申請弱點掃描後，收到報告開始修正弱點和漏洞時，發現太久沒有碰伺服器相關的議題，安全性的設定多出來非常的多。

參考網站：http://lab.aoetek.com/index.php/2018/09/27/2018092701/

備份參考網站，以後再有需要時可以快速找到。

OWASP 列出幾個 Header 需要安全性設定及描述，而 這裡 有設定參考

# vi /etc/httpd/conf.d/secure.conf

# Clickjacking protection: allow iframes from same origin

Header always append X-Frame-Options "SAMEORIGIN "

Header always append Frame-Options "SAMEORIGIN"

# Enforce HTTPS connections for all requests, including subdomains

Header always append STRICT-TRANSPORT-SECURITY "max-age=16070400; includeSubDomains"

# IE8+ and variants, XSS Protection

Header always append X-XSS-Protection "1;mode=block"

# Protection from drive-by dynamic/executable IE files

Header always append X-Content-Type-Options "nosniff"

# Strict Content Security Policy, deny all external requests

# for custom CSP headers use: http://cspbuilder.info/

# 這個要小心使用，它會讓網站版面壞掉

Header always append Content-Security-Policy "default-src 'none'; script-src 'self'; connect-src: 'self'; img-src: 'self'; style-src: 'self';"

Header always append X-Content-Security-Policy "default-src 'none'; script-src 'self'; connect-src: 'self'; img-src: 'self'; style-src: 'self';"

Header always append X-WebKit-CSP "default-src 'none'; script-src 'self'; connect-src: 'self'; img-src: 'self'; style-src: 'self';"

# hidden php

Header unset X-Powered-By

有關內容安全政策（Content-Security-Policy, CSP）上面，我的設定是："default-src 'self' https:; img-src 'self' https: data:; frame-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:;"

最近又多一個 Permissions-Policy

Header always append Permissions-Policy "geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()"

防止403（Forbidden）洩漏路徑資料夾訊乏

ErrorDocument 403 /404.php #用404.php來代替

404.php的內容：

<?php

# your custom 404 content goes here

# now make it return 404 status to browser

http_response_code(404);

?>