diff --git a/xCAT/debian/postinst b/xCAT/debian/postinst index 299450e15..d47009379 100644 --- a/xCAT/debian/postinst +++ b/xCAT/debian/postinst @@ -45,6 +45,14 @@ case "$1" in ln -s -f /etc/apache2/conf-available/xcat.conf.apach24 /etc/apache2/conf-enabled/xcat.conf + # xcat.conf sets security response headers via mod_headers, which is + # not enabled by default on Debian/Ubuntu. Enable it so the headers + # take effect (the directives are wrapped in + # so a missing module never breaks the apache restart below). + if command -v a2enmod >/dev/null 2>&1; then + a2enmod -q headers >/dev/null 2>&1 || : + fi + /etc/init.d/apache2 restart # Let rsyslogd perform close of any open files diff --git a/xCAT/xcat.conf b/xCAT/xcat.conf index 6138086c4..c205a24f9 100644 --- a/xCAT/xcat.conf +++ b/xCAT/xcat.conf @@ -4,17 +4,31 @@ # http://localhost/xcat-doc/ # Updates to xCAT/xcat.conf should also be made to xCATsn/xcat.conf # +ServerTokens Prod + AliasMatch ^/install/(.*)$ "/install/$1" AliasMatch ^/tftpboot/(.*)$ "/tftpboot/$1" - Options FollowSymLinks Includes MultiViews + Options FollowSymLinks + + Header always set X-Frame-Options SAMEORIGIN + Header always set X-Content-Type-Options nosniff + Header always set Content-Security-Policy "script-src 'self' 'unsafe-eval'" + Header always set X-Permitted-Cross-Domain-Policies none + AllowOverride None Order allow,deny Allow from all - Options FollowSymLinks Includes MultiViews + Options FollowSymLinks + + Header always set X-Frame-Options SAMEORIGIN + Header always set X-Content-Type-Options nosniff + Header always set Content-Security-Policy "script-src 'self' 'unsafe-eval'" + Header always set X-Permitted-Cross-Domain-Policies none + AllowOverride None Order allow,deny Allow from all diff --git a/xCAT/xcat.conf.apach24 b/xCAT/xcat.conf.apach24 index d1720149f..0b032f246 100644 --- a/xCAT/xcat.conf.apach24 +++ b/xCAT/xcat.conf.apach24 @@ -4,16 +4,30 @@ # http://localhost/xcat-doc/ # Updates to xCAT/xcat.conf should also be made to xCATsn/xcat.conf # +ServerTokens Prod + AliasMatch ^/install/(.*)$ "/install/$1" AliasMatch ^/tftpboot/(.*)$ "/tftpboot/$1" - Options FollowSymLinks Includes MultiViews + Options FollowSymLinks + + Header always set X-Frame-Options SAMEORIGIN + Header always set X-Content-Type-Options nosniff + Header always set Content-Security-Policy "script-src 'self' 'unsafe-eval'" + Header always set X-Permitted-Cross-Domain-Policies none + AllowOverride None Require all granted - Options FollowSymLinks Includes MultiViews + Options FollowSymLinks + + Header always set X-Frame-Options SAMEORIGIN + Header always set X-Content-Type-Options nosniff + Header always set Content-Security-Policy "script-src 'self' 'unsafe-eval'" + Header always set X-Permitted-Cross-Domain-Policies none + AllowOverride None Require all granted diff --git a/xCATsn/debian/postinst b/xCATsn/debian/postinst index c7056f716..f674fb7eb 100644 --- a/xCATsn/debian/postinst +++ b/xCATsn/debian/postinst @@ -56,6 +56,14 @@ case "$1" in update-rc.d $apachedaemon enable + # xcat.conf sets security response headers via mod_headers, which is not + # enabled by default on Debian/Ubuntu. Enable it so the headers take + # effect (directives are wrapped in so a missing + # module never breaks the apache reload below). + if command -v a2enmod >/dev/null 2>&1; then + a2enmod -q headers >/dev/null 2>&1 || : + fi + if [ -f "/proc/cmdline" ]; then # prevent running it during install into chroot image if [ -d /run/systemd/system ] && command -v systemctl >/dev/null 2>&1; then systemctl start xcatd.service diff --git a/xCATsn/xcat.conf b/xCATsn/xcat.conf index 6138086c4..c205a24f9 100644 --- a/xCATsn/xcat.conf +++ b/xCATsn/xcat.conf @@ -4,17 +4,31 @@ # http://localhost/xcat-doc/ # Updates to xCAT/xcat.conf should also be made to xCATsn/xcat.conf # +ServerTokens Prod + AliasMatch ^/install/(.*)$ "/install/$1" AliasMatch ^/tftpboot/(.*)$ "/tftpboot/$1" - Options FollowSymLinks Includes MultiViews + Options FollowSymLinks + + Header always set X-Frame-Options SAMEORIGIN + Header always set X-Content-Type-Options nosniff + Header always set Content-Security-Policy "script-src 'self' 'unsafe-eval'" + Header always set X-Permitted-Cross-Domain-Policies none + AllowOverride None Order allow,deny Allow from all - Options FollowSymLinks Includes MultiViews + Options FollowSymLinks + + Header always set X-Frame-Options SAMEORIGIN + Header always set X-Content-Type-Options nosniff + Header always set Content-Security-Policy "script-src 'self' 'unsafe-eval'" + Header always set X-Permitted-Cross-Domain-Policies none + AllowOverride None Order allow,deny Allow from all diff --git a/xCATsn/xcat.conf.apach24 b/xCATsn/xcat.conf.apach24 index 0abfff396..251111903 100644 --- a/xCATsn/xcat.conf.apach24 +++ b/xCATsn/xcat.conf.apach24 @@ -4,16 +4,30 @@ # http://localhost/xcat-doc/ # Updates to xCAT/xcat.conf should also be made to xCATsn/xcat.conf # +ServerTokens Prod + AliasMatch ^/install/(.*)$ "/install/$1" AliasMatch ^/tftpboot/(.*)$ "/tftpboot/$1" - Options FollowSymLinks Includes MultiViews + Options FollowSymLinks + + Header always set X-Frame-Options SAMEORIGIN + Header always set X-Content-Type-Options nosniff + Header always set Content-Security-Policy "script-src 'self' 'unsafe-eval'" + Header always set X-Permitted-Cross-Domain-Policies none + AllowOverride None Require all granted - Options FollowSymLinks Includes MultiViews + Options FollowSymLinks + + Header always set X-Frame-Options SAMEORIGIN + Header always set X-Content-Type-Options nosniff + Header always set Content-Security-Policy "script-src 'self' 'unsafe-eval'" + Header always set X-Permitted-Cross-Domain-Policies none + AllowOverride None Require all granted