mirror of
https://github.com/xcat2/xcat-core.git
synced 2026-08-04 08:26:59 +00:00
Vinícius Ferrão
9261a765bd
Add standard security response headers (X-Frame-Options, X-Content-Type- Options, Content-Security-Policy, X-Permitted-Cross-Domain-Policies) to the /install and /tftpboot directories, mask the server banner with "ServerTokens Prod", and drop the Includes (SSI) and MultiViews options from those file-serving directories. Indexes on /install/postscripts, /install/post and the doc directory are left intact so directory browsing still works where xCAT relies on it. The Header directives are wrapped in <IfModule mod_headers.c> so a server whose mod_headers is not loaded still starts cleanly instead of failing on an unknown directive. On Debian/Ubuntu, where mod_headers is not enabled by default, the xCAT and xCATsn package postinst scripts run "a2enmod headers" before restarting Apache so the headers take effect there as well; on RHEL/SLES the module is loaded by default and needs no action. Recovered from the unmerged lenovobuild branch (originals7ee0c129,85c8bc09,d4d1783a), adapted: the deprecated X-XSS-Protection header and the mod_allowmethods-dependent AllowMethods directive are omitted, and the Header directives use "set" rather than "append". Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
56 lines
1.6 KiB
Plaintext
56 lines
1.6 KiB
Plaintext
#
|
|
# This configuration file allows a diskfull install to access the install images
|
|
# via http. It also allows the xCAT documentation to be accessed via
|
|
# http://localhost/xcat-doc/
|
|
# Updates to xCAT/xcat.conf should also be made to xCATsn/xcat.conf
|
|
#
|
|
ServerTokens Prod
|
|
|
|
AliasMatch ^/install/(.*)$ "/install/$1"
|
|
AliasMatch ^/tftpboot/(.*)$ "/tftpboot/$1"
|
|
|
|
<Directory "/tftpboot">
|
|
Options FollowSymLinks
|
|
<IfModule mod_headers.c>
|
|
Header always set X-Frame-Options SAMEORIGIN
|
|
Header always set X-Content-Type-Options nosniff
|
|
Header always set Content-Security-Policy "script-src 'self' 'unsafe-eval'"
|
|
Header always set X-Permitted-Cross-Domain-Policies none
|
|
</IfModule>
|
|
AllowOverride None
|
|
Order allow,deny
|
|
Allow from all
|
|
</Directory>
|
|
<Directory "/install">
|
|
Options FollowSymLinks
|
|
<IfModule mod_headers.c>
|
|
Header always set X-Frame-Options SAMEORIGIN
|
|
Header always set X-Content-Type-Options nosniff
|
|
Header always set Content-Security-Policy "script-src 'self' 'unsafe-eval'"
|
|
Header always set X-Permitted-Cross-Domain-Policies none
|
|
</IfModule>
|
|
AllowOverride None
|
|
Order allow,deny
|
|
Allow from all
|
|
</Directory>
|
|
<Directory "/install/postscripts">
|
|
Options Indexes FollowSymLinks
|
|
AllowOverride None
|
|
Order allow,deny
|
|
Allow from all
|
|
</Directory>
|
|
<Directory "/install/post">
|
|
Options Indexes FollowSymLinks
|
|
AllowOverride None
|
|
Order allow,deny
|
|
Allow from all
|
|
</Directory>
|
|
|
|
Alias /xcat-doc "/opt/xcat/share/doc"
|
|
<Directory "/opt/xcat/share/doc">
|
|
Options Indexes
|
|
AllowOverride None
|
|
Order allow,deny
|
|
Allow from all
|
|
</Directory>
|