Posts by bglaessn

  • Howto add special headers such as the X-Frame-Options header?

    Is this correct ?


    HTML
    1. # grep "X-Content-Type" /etc/* -R/etc/apache2/conf-enabled/security.conf:#Header set X-Content-Type-Options: "nosniff"/etc/apache2/conf-available/security.conf:#Header set X-Content-Type-Options: "nosniff"/etc/imscp/listeners.d/40_apache2_security_headers.pl: Header always set X-Content-Type-Options "nosniff"


  • Howto add special headers such as the X-Frame-Options header?

    Update:


    I have added some lines to the 40_apache2_security_headers.pl

    Perl
    1. ...package Listener::Apache2::Security::Headers;use iMSCP::EventManager;use iMSCP::TemplateParser;use strict;use warnings;my $filename = '/tmp/listener.txt';open(my $fh, '>', $filename) or die "Could not open file '$filename' $!";print $fh "Listener started.\n";close $fh;iMSCP::EventManager->getInstance()->register( 'beforeHttpdBuildConf',...


    and restarted the installer.


    After this

    Shell-Script
    1. # cat /tmp/listener.txt
    2. Listener started.

    So I guess, that everything is fine with the installation itself.

  • Howto add special headers such as the X-Frame-Options header?

    Update:


    Have tried listener versions 1.4, 1.5 also... Nothing changed.
    Listener version 1.6 give the following error while starting the installer:


    Shell-Script
    1. [FATAL] iMSCP::EventManager::_init: "getBlocByRef" is not exported by the iMSCP::TemplateParser module
    2. "replaceBlocByRef" is not exported by the iMSCP::TemplateParser module
    3. Can't continue after import errors at /etc/imscp/listeners.d/40_apache2_security_headers.pl line 30.
    4. BEGIN failed--compilation aborted at /etc/imscp/listeners.d/40_apache2_security_headers.pl line 30, <$fh> line 370.
    5. Compilation failed in require at /root/Downloads/imscp-1.3.16/engine/PerlLib/iMSCP/EventManager.pm line 174, <$fh> line 370.

  • Howto add special headers such as the X-Frame-Options header?

    Hi,


    For my i-mscp 1.3.6 I have done the follwing:


    Downloaded the listener-version 1.3.x from GitHub (https://github.com/i-MSCP/imsc…ache2_security_headers.pl) and placed the file to /etc/imscp/listeners.d/40_apache2_security_headers.pl


    After this, I triggered the installer with "perl imscp-autoinstall -d" and choosed "automatic".
    The installer runs fine and completed successfully.


    But https://securityheaders.io still reports, that no security headers are active.


    Restart of apache and php-5fpm didn´t solve the problem.


  • Custom config via /etc/apache2/imscp/[domain.com].conf or .htaccess not working

    Hi folks,


    I am trying to disable HTTP OPTIONS for security reasons in i-MSCP 1.3.16 (Build: 20170107).


    Short explanation:


    If I drop a


    Code
    1. # curl -i -X OPTIONS http://139.1.x.xHTTP/1.1 200 OKDate: Fri, 05 May 2017 10:25:16 GMTServer: ApacheStrict-Transport-Security: max-age=31536000; includeSubDomainX-Frame-Options: sameoriginX-Content-Type-Options: nosniffAllow: GET,HEAD,POST,OPTIONSX-Frame-Options: sameoriginContent-Length: 0Content-Type: text/html


    The "Allow" for OPTIONS should not be displayed.


    So I added the following lines to /etc/apache2/imscp/mydomain.com.conf


    Code
    1. RewriteEngine
    2. OnRewriteCond %{REQUEST_METHOD} !^(GET|POST|HEAD)
    3. RewriteRule .* - [R=405,L]


    and reloaded my Apache.


    Additionally, I added a .htaccess with the same content in my document root.


    Noting changed so far.


    Any help would be appreciated. Thanx !
    BG