What you will do
A web server often says more than it needs to: its exact version, the files in a folder, files nobody meant to publish. Hardening is changing its configuration so it says and shows less. You will look at a small website, run a check that lists what is wrong, fix one thing inside the running server, and run the check again. Your copy has no way out to the internet, so the only site you touch is your own.
Before you start
Note
Press Start the lab on the bar at the top of this lesson and wait until it says it is running. The website is the service called web, and the terminal reaches it by that name. Each Run button below types its command into your lab's terminal, one after another in the same session. To watch them, or to type your own, press Open terminal on the bar.
1. See what the server says
curl -I asks for the headers only. Look at the line that begins Server:. It tells every visitor, and every attacker, the exact version of nginx: nginx/1.27.5.
curl -I http://webShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
2. See what it shows
This folder has no home page of its own, so the server lists what is in it. The answer is a page headed Index of /files/ with two files, prices.csv and suppliers.txt. Nothing here asked for a list to be shown.
curl http://web/files/Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
3. Run the check
docker in this terminal can look at, enter and restart the lab's service, and this runs a command inside it. lab-check asks the running server nine questions and prints PASS or FAIL for each. At the start every one says FAIL, and the last line is Some checks fail.
docker exec web lab-checkShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
4. Fix one thing
The configuration is the file /etc/nginx/conf.d/default.conf inside the container. It says server_tokens on;, which is what puts the version in the header. This command changes on to off. sed is an editor that makes one change from the command line. For bigger changes, open the file with docker exec -it web sh and edit it with vi.
docker exec web sed -i 's/server_tokens on/server_tokens off/' /etc/nginx/conf.d/default.confShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
5. Load it
nginx reads its configuration once, so you tell it to read it again. reload does that without stopping the site. It prints one notice, signal process started, which is not an error.
docker exec web nginx -s reloadShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
6. Look again
The Server: line now says only nginx, with no number.
curl -I http://webShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
7. Run the check again
The first line is now PASS the Server header shows no version number, and the other eight still say FAIL: each fix turns only its own line. The folder listing, the missing security headers, the .git folder, the backup file and the open admin area are yours to fix the same way, until the last line says All checks pass.
docker exec web lab-checkShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
8. See what lasts
Press Stop the lab on the lab bar and then Start the lab again, and run the check once more: your fix is still there. The configuration folder is a named volume, and the platform saves volumes. A change made anywhere else in the container would be gone.
For teachers
Tip
This lesson is a small example of a lesson worked in a lab: the steps and the Run buttons are the lesson, and the lab is each student's own copy. Nothing here marks itself: the student hands in the curl -I output before and after, and the last lab-check, and you mark the evidence. Copy it into your own module and change it, or build one from scratch with the Lab menu in the lesson builder.