CentOS – Apache configuration #2

Continuing from the first CentOS Apache configuration article, we now look at some of the other settings in the main httpd.conf file and what they can do.

Concentrating on efficiency and security, this will end our httpd.conf journey (for now).

ServerName

Default: Not Set

The ServerName is usually a hostname or a FQDN (Fully Qualified Domain Name).
If you set followed the CentOS installing Apache and PHP5 article, you will have already set the ServerName configuration.

If you fail to set the ServerName then on an Apache restart you will see the following warning:

Starting httpd: httpd: Could not reliably determine the server’s fully qualified domain name,
using 127.0.0.1 for ServerName

HostnameLookups

Default:

HostnameLookups Off

If you want happy users and to save traffic, keep this at Off.

Setting this to ‘On’ will enable DNS lookups so host names can be logged (it performs a reverse DNS check), setting it to ‘Double’ will not only perform the reverse DNS check it will then check the resulting hostname.

ServerTokens

Default:

ServerTokens OS

The ServerTokens setting will dictate how much information is sent in the Headers with regard to Apache version and modules in use.

The default (Set as ‘OS”) would send something like this:

Apache/2.2.3 (CentOS)

Does this make a difference? Well, yes. If we can suppress that information it will make it harder for someone to find an exploit.

It does not make the actual install any more secure but all someone has to do right now is look for an exploit in CentOS Apache 2.2.3 and so on. Why make it easy for them?
The options are (with example outputs):
Full

Apache/2.2.3 (CentOS) DAV/2 PHP/5.1.6 mod_ssl/2.2.3 OpenSSL/0.9.8b

OS

Apache/2.2.3 (CentOS)

Minimal

Apache/2.2.3

Minor

Apache/2.2

Major

Apache/2

Prod

Apache

It’s up to you what level of info you want to give out. I prefer setting ServerTokens to Prod.

ServerSignature

Default:

ServerSignature On

Reload

After each change to the httpd.conf file, you will need to reload Apache for the settings to take effect:

/etc/init.d/httpd reload