A bakery site that says too much
A bakery's website works well. But it tells every visitor the exact version of the software behind it. It lists every file in a folder of price lists. It even serves an old backup of a settings file.
Nobody attacked it. It was simply never told to say less.
The one rule
Warning
This lab is a web server that is weak on purpose. Work on your own private copy and nothing else. It has no way out to the internet. Never probe a server that is not yours: in the UK that is a crime under the Computer Misuse Act 1990.
By the end of this lesson
Note
I can say what a web server should hide and what it should refuse.
Key words
| Word | What it means | Example |
|---|---|---|
| Hardening | changing settings so a system gives away and allows less | |
| Header | a line at the start of a reply that tells the browser how to treat it | Server: nginx |
| Directory listing | a page that lists every file in a folder | |
| TLS | the system that encrypts traffic between a browser and a site | |
| Certificate | a signed file that proves a site is who it says | |
| HSTS | a header telling browsers to use only the secure address |
The cells students fill in are left blank in this preview.
A server should say less
Every extra word a server says helps an attacker. A version number tells them which known flaws to try. A folder list shows files nobody meant to publish.
Hardening removes what is not needed: the version in the Server header, folder listings, backup and settings files, and any admin area open to all.
Look at your lab's server
Your lab runs a small bakery site on nginx. Start it, then run these four. They only read. The first shows the status line. The second shows the Server header. The third counts one security header. The fourth reads a folder page.
The status line
curl -s -I http://web | head -n 1Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
The Server header
curl -s -I http://web | grep -i "^server"Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
How many X-Frame-Options headers?
curl -s -I http://web | grep -ci "x-frame-options"Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
What a folder page is headed
curl -s http://web/files/ | grep -o "Index of [a-z/]*"Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Worked example: reading the four answers
| Run | Prints | What it means |
|---|---|---|
| Status line | HTTP/1.1 200 OK | The site answers |
| Server header | Server: nginx/1.27.5 | It gives its exact version to everybody |
| X-Frame-Options | 0 | This protective header is not sent at all |
| Folder page | Index of /files/, twice | The server lists a folder instead of refusing: once in the title, once in the heading |
The cells students fill in are left blank in this preview.
Security headers tell the browser how to behave
A few headers cost nothing and close whole classes of problem. X-Content-Type-Options: nosniff stops a browser guessing a file's type. X-Frame-Options stops other sites framing your page.
Content-Security-Policy limits which scripts may run. Referrer-Policy limits what address is passed on to other sites.
A common mistake
Warning
Many people think hiding the version number makes a server secure. It only hides one clue. An old server with a known flaw is still weak. Hide the clue, but also keep the software up to date and remove what it does not need.
Traffic should be encrypted with a current TLS
TLS has versions. SSL 3, TLS 1.0 and TLS 1.1 are old and no longer safe. Allow TLS 1.2 and 1.3 only.
A good setup also has a certificate that is trusted and has not expired. It redirects the plain address to the secure one. It sends HSTS so browsers remember to use the secure address.
Least exposed means only what is needed
Serve only the files the site needs. Keep backups, source control folders and settings files out of the web folder. Put the admin area behind a sign-in or a network limit.
Each thing you remove is one fewer thing to protect.