Web Server Security task marked failed!

Tej-Singh-Rana · May 24, 2020, 6:26pm

Check in Display port section. It will show you web page. If you did correct then it will not show you apache web server version.

yogendra · May 25, 2020, 7:32am

Hi @Tej-Singh-Rana thanks for replying.

Could you please guide me where exactly i need to verify, i am not sure Display port section means. Kindly assist.

Thanks,
Yogendra

Tej-Singh-Rana · May 25, 2020, 8:53am

In the Web preview section right? that section have Select Port to view Host 1. This option will show you page after giving Port input in blank box.

karthikms · May 31, 2020, 5:15am

@yogendra are you able to complete the task?

if yes kindly help
i just don’t understand what the steps to be done for Q.no a.

thanks

yogendra · May 31, 2020, 7:37am

Hi @karthikms

I have worked as mentioned in my snips above, unfortunately i ended up with result as Task Failed.
Please do some more research from your end (i was able to do only as above) and try to perform, all the best.

Regards,
Yogendra

karthikms · June 1, 2020, 4:44am

i think you were supposed to do All access granted . i think thats where you went wrong.

thanks @yogendra

Surendar · June 16, 2020, 5:37am

I tired to access the " Select Port to view Host 1" and choose the port number as 8080…but still I’m getting view of Quiz question page…which port number should i give the view the apache web page

swaroopcs88 · July 6, 2020, 3:37am

@Salim @devops503 @Inderpreet @Tej-Singh-Rana

Hi All,

As part of this task.

Before updating the httpd.conf.

I added the below commands towards the end of httpd.conf.

other than this changes, I didn’t do any other changes. the task was failed after submitted.

let me know where did I go wrong. Thank you!
Swaroop

devops503 · July 10, 2020, 1:51am

Please take a look to

selvag · August 7, 2020, 5:16am

sudo systemctl start httpd

sudo systemctl status httpd

Added below 2 lines end of config file : /etc/httpd/conf/httpd.conf

ServerTokens Prod
ServerSignature Off

Modified below details in config file

<Directory “/var/www/html”>
Options -Indexes +FollowSymLinks
AllowOverride None
Require all granted

sudo systemctl restart httpd

Its worked for me.

NVKrishna · August 16, 2020, 12:55am

Got succeeded with above leads. Thanks devops503 and selvag.

bhargavmendapara115 · September 5, 2020, 2:30pm

Hi @Salim,

In your steps you forgot to include on how to hide apache version number.

For all - please refer below tutorials for this task.

Thanks,
Bhargav

bhargavmendapara115 · September 5, 2020, 2:31pm

Hi @Salim,

In your steps you forgot to include on how to hide apache version number.

For all - please refer below tutorials for this task.

Thanks,
Bhargav

praddasg · November 8, 2020, 10:07pm

Hello @Inderpreet @Tej-Singh-Rana, can you please help here to understand
I IONOS Cloud Documentation - Products to disable the directory listing)

Please suggest what is wrong. Is it because I have marked the directive AllowOverride as None. Should this be All?
As per Disable Apache Web Directory Listing Using .htaccess File, it says to create .htaccess file.
a. What is the difference between creating this file and updating the same details in httpd.conf file?
b. which path do I need to create .htaccess file?
c. Also how is there a way to verify if directory listing has been disabled?

Inderpreet · December 28, 2020, 8:02am

Hi @praddasg

AllowOverride All means you are allowing Apache to overwrite config settings for a particular directory location using .htaccess file. If you have set AllowOverride None then even if you keep .htaccess under that directory location it won’t be effective.
Whatever path is asked in the question to disable directory listing for e.g /var/www/html/
Lets say if apache document root is /var/www/html and you have disabled directory listing for /var/www/html/somedir then you can check in the browser by opening this URL http://<your-website>/somedir, it should not list the files/directories present under /var/www/html/somedir directory.

praddasg · February 15, 2021, 2:44am

Hi @Inderpreet @Tej-Singh-Rana
Is there any other way to verify if directory listing is indeed disabled using curl or any other command line utility?
The challenge here is, I am not able to verify using browser

Inderpreet · February 17, 2021, 5:46am

@praddasg

If you are seeing your data listed in the browser after accessing "http://“your-website”/somedir URL then directory listing isn’t disabled for this directory.

You can also use command line utility like elinks to test the same.

shawon10 · February 20, 2021, 1:25pm

Solution for beginners: Web Server Security Kodekloud

6stringsaber · March 22, 2021, 9:22am

For Tutorial/Solution. Content made for sole reason to help the community.

hardiku87 · August 16, 2021, 10:32am

it should be allowedoverride all not none