rules-apache

RISK: 'AllowOverride All' lets any .htaccess file in the document root override security directives — a single writable directory lets an attacker re-enable directory listings, add PHP handlers, or bypass authentication. FIX: set 'AllowOverride None' at the root and grant only the specific override categories needed (e.g., 'AllowOverride AuthConfig') for directories that require it.

Enabling 'Indexes' allows directory listing, exposing your file structure and sensitive files to the public. Use 'Options -Indexes' to disable this.

RISK: writing a .htpasswd file inside the web document root makes it retrievable via HTTP GET if .htaccess protection is misconfigured or absent. Even with MD5-hashed credentials, offline cracking is trivial. FIX: store .htpasswd above the DocumentRoot (e.g., /etc/apache2/.htpasswd) and reference it with an absolute path in the AuthUserFile directive.

RISK: mod_status/mod_info handler without 'Require local' exposes detailed server internals (worker state, request URLs, client IPs, uptime, module list) to any internet client — reconnaissance goldmine for attackers. FIX: restrict with 'Require local' or a named IP allowlist inside the <Location /server-status> block, or remove the handler entirely in production.

The root directory (<Directory />) must be locked down by default to prevent access to the entire server file system. Ensure 'Require all denied' is set.

Apache reveals its version and OS information by default. Attackers use this for reconnaissance. Add 'ServerTokens Prod' to hide version details.

RISK: TraceEnable On enables the HTTP TRACE method, which is exploitable via Cross-Site Tracing (XST — OWASP A05) to steal session cookies even when HttpOnly is set, because TRACE echoes all request headers including cookies. FIX: add 'TraceEnable Off' to the global server config or every VirtualHost block. Most modern Apache installs default to Off, but explicit config prevents it being re-enabled by accident.

Enabling weak or deprecated SSL/TLS protocols (SSLv2, SSLv3, TLS 1.0, TLS 1.1) exposes the server to cryptographic downgrade attacks. Allow only TLSv1.2 and TLSv1.3.