fix(httpd): harden the xCAT Apache configuration

Add standard security response headers (X-Frame-Options, X-Content-Type-
Options, Content-Security-Policy, X-Permitted-Cross-Domain-Policies) to the
/install and /tftpboot directories, mask the server banner with
"ServerTokens Prod", and drop the Includes (SSI) and MultiViews options from
those file-serving directories. Indexes on /install/postscripts, /install/post
and the doc directory are left intact so directory browsing still works where
xCAT relies on it.

The Header directives are wrapped in <IfModule mod_headers.c> so a server
whose mod_headers is not loaded still starts cleanly instead of failing on an
unknown directive. On Debian/Ubuntu, where mod_headers is not enabled by
default, the xCAT and xCATsn package postinst scripts run "a2enmod headers"
before restarting Apache so the headers take effect there as well; on
RHEL/SLES the module is loaded by default and needs no action.

Recovered from the unmerged lenovobuild branch (originals 7ee0c129, 85c8bc09,
d4d1783a), adapted: the deprecated X-XSS-Protection header and the
mod_allowmethods-dependent AllowMethods directive are omitted, and the Header
directives use "set" rather than "append".

Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>

xCAT/debian/postinst

@@ -45,6 +45,14 @@ case "$1" in
 
         ln -s -f /etc/apache2/conf-available/xcat.conf.apach24 /etc/apache2/conf-enabled/xcat.conf
 
+        # xcat.conf sets security response headers via mod_headers, which is
+        # not enabled by default on Debian/Ubuntu.  Enable it so the headers
+        # take effect (the directives are wrapped in <IfModule mod_headers.c>
+        # so a missing module never breaks the apache restart below).
+        if command -v a2enmod >/dev/null 2>&1; then
+            a2enmod -q headers >/dev/null 2>&1 || :
+        fi
+
         /etc/init.d/apache2 restart
 
         # Let rsyslogd perform close of any open files

xCAT/xcat.conf

@@ -4,17 +4,31 @@
 # http://localhost/xcat-doc/
 # Updates to xCAT/xcat.conf should also be made to xCATsn/xcat.conf
 #
+ServerTokens Prod
+
 AliasMatch ^/install/(.*)$ "/install/$1"
 AliasMatch ^/tftpboot/(.*)$ "/tftpboot/$1"
 
 <Directory "/tftpboot">
-    Options FollowSymLinks Includes MultiViews
+    Options FollowSymLinks
+    <IfModule mod_headers.c>
+        Header always set X-Frame-Options SAMEORIGIN
+        Header always set X-Content-Type-Options nosniff
+        Header always set Content-Security-Policy "script-src 'self' 'unsafe-eval'"
+        Header always set X-Permitted-Cross-Domain-Policies none
+    </IfModule>
     AllowOverride None
     Order allow,deny
     Allow from all
 </Directory>
 <Directory "/install">
-    Options FollowSymLinks Includes MultiViews
+    Options FollowSymLinks
+    <IfModule mod_headers.c>
+        Header always set X-Frame-Options SAMEORIGIN
+        Header always set X-Content-Type-Options nosniff
+        Header always set Content-Security-Policy "script-src 'self' 'unsafe-eval'"
+        Header always set X-Permitted-Cross-Domain-Policies none
+    </IfModule>
     AllowOverride None
     Order allow,deny
     Allow from all

xCAT/xcat.conf.apach24

@@ -4,16 +4,30 @@
 # http://localhost/xcat-doc/
 # Updates to xCAT/xcat.conf should also be made to xCATsn/xcat.conf
 #
+ServerTokens Prod
+
 AliasMatch ^/install/(.*)$ "/install/$1"
 AliasMatch ^/tftpboot/(.*)$ "/tftpboot/$1"
 
 <Directory "/tftpboot">
-    Options FollowSymLinks Includes MultiViews
+    Options FollowSymLinks
+    <IfModule mod_headers.c>
+        Header always set X-Frame-Options SAMEORIGIN
+        Header always set X-Content-Type-Options nosniff
+        Header always set Content-Security-Policy "script-src 'self' 'unsafe-eval'"
+        Header always set X-Permitted-Cross-Domain-Policies none
+    </IfModule>
     AllowOverride None
     Require all granted
 </Directory>
 <Directory "/install">
-    Options FollowSymLinks Includes MultiViews
+    Options FollowSymLinks
+    <IfModule mod_headers.c>
+        Header always set X-Frame-Options SAMEORIGIN
+        Header always set X-Content-Type-Options nosniff
+        Header always set Content-Security-Policy "script-src 'self' 'unsafe-eval'"
+        Header always set X-Permitted-Cross-Domain-Policies none
+    </IfModule>
     AllowOverride None
     Require all granted
 </Directory>

xCATsn/debian/postinst

@@ -56,6 +56,14 @@ case "$1" in
 
       update-rc.d $apachedaemon enable
 
+      # xcat.conf sets security response headers via mod_headers, which is not
+      # enabled by default on Debian/Ubuntu.  Enable it so the headers take
+      # effect (directives are wrapped in <IfModule mod_headers.c> so a missing
+      # module never breaks the apache reload below).
+      if command -v a2enmod >/dev/null 2>&1; then
+          a2enmod -q headers >/dev/null 2>&1 || :
+      fi
+
       if [ -f "/proc/cmdline" ]; then   # prevent running it during install into chroot image
 	 if [ -d /run/systemd/system ] && command -v systemctl >/dev/null 2>&1; then
 	    systemctl start xcatd.service

xCATsn/xcat.conf

@@ -4,17 +4,31 @@
 # http://localhost/xcat-doc/
 # Updates to xCAT/xcat.conf should also be made to xCATsn/xcat.conf
 #
+ServerTokens Prod
+
 AliasMatch ^/install/(.*)$ "/install/$1"
 AliasMatch ^/tftpboot/(.*)$ "/tftpboot/$1"
 
 <Directory "/tftpboot">
-    Options FollowSymLinks Includes MultiViews
+    Options FollowSymLinks
+    <IfModule mod_headers.c>
+        Header always set X-Frame-Options SAMEORIGIN
+        Header always set X-Content-Type-Options nosniff
+        Header always set Content-Security-Policy "script-src 'self' 'unsafe-eval'"
+        Header always set X-Permitted-Cross-Domain-Policies none
+    </IfModule>
     AllowOverride None
     Order allow,deny
     Allow from all
 </Directory>
 <Directory "/install">
-    Options FollowSymLinks Includes MultiViews
+    Options FollowSymLinks
+    <IfModule mod_headers.c>
+        Header always set X-Frame-Options SAMEORIGIN
+        Header always set X-Content-Type-Options nosniff
+        Header always set Content-Security-Policy "script-src 'self' 'unsafe-eval'"
+        Header always set X-Permitted-Cross-Domain-Policies none
+    </IfModule>
     AllowOverride None
     Order allow,deny
     Allow from all

xCATsn/xcat.conf.apach24

@@ -4,16 +4,30 @@
 # http://localhost/xcat-doc/
 # Updates to xCAT/xcat.conf should also be made to xCATsn/xcat.conf
 #
+ServerTokens Prod
+
 AliasMatch ^/install/(.*)$ "/install/$1"
 AliasMatch ^/tftpboot/(.*)$ "/tftpboot/$1"
 
 <Directory "/tftpboot">
-    Options FollowSymLinks Includes MultiViews
+    Options FollowSymLinks
+    <IfModule mod_headers.c>
+        Header always set X-Frame-Options SAMEORIGIN
+        Header always set X-Content-Type-Options nosniff
+        Header always set Content-Security-Policy "script-src 'self' 'unsafe-eval'"
+        Header always set X-Permitted-Cross-Domain-Policies none
+    </IfModule>
     AllowOverride None
     Require all granted
 </Directory>
 <Directory "/install">
-    Options FollowSymLinks Includes MultiViews
+    Options FollowSymLinks
+    <IfModule mod_headers.c>
+        Header always set X-Frame-Options SAMEORIGIN
+        Header always set X-Content-Type-Options nosniff
+        Header always set Content-Security-Policy "script-src 'self' 'unsafe-eval'"
+        Header always set X-Permitted-Cross-Domain-Policies none
+    </IfModule>
     AllowOverride None
     Require all granted
 </Directory>