Web Server Hardening

Scope

What this is: Securing Apache, Nginx, and IIS web servers through configuration hardening, TLS deployment, and security headers.

Competition relevance: Infrastructure hardening. Focus on SSL/TLS, security headers, and eliminating information disclosure.

Why it matters: Web servers are public-facing attack surfaces. Misconfigurations lead to compromise or information leakage.

WSOS 2026 alignment: This topic directly supports Section 4: Secure systems operation and maintenance (configuring and maintaining web server infrastructure) and Section 5: Secure systems protection and defence (implementing TLS encryption and security controls on public-facing services).

Competition area: Spans the infrastructure hardening area (web server deployment and configuration) and the infrastructure hardening area (secure coding) (implementing web security headers and preventing information disclosure).

Offline competence: Use Apache/Nginx documentation in /usr/share/doc/apache2 or /usr/share/doc/nginx, check man openssl for certificate operations, and reference Mozilla SSL Configuration Generator (download offline). Test configurations with nginx -t or apachectl configtest without internet.

---

Competency Matrix

Level	Expectation
Regional	Deploy self-signed SSL certificate. Configure HTTPS redirect. Basic security headers.
National	Deploy proper CA-signed certificate with full chain. Strong cipher suites. HSTS implementation.
Squad/Team Selection	Perfect Forward Secrecy. OCSP stapling. Content Security Policy (CSP).
International	Mutual TLS. Certificate pinning. Advanced CSP with nonces.

---

Technical Content

SSL/TLS Setup

Generate self-signed certificate (regional):

# OpenSSL
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes -subj "/CN=example.com"

# Apache configuration
<VirtualHost *:443>
    ServerName example.com
    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/cert.pem
    SSLCertificateKeyFile /etc/ssl/private/key.pem
</VirtualHost>

# Enable SSL module
a2enmod ssl
systemctl restart apache2

Nginx SSL:

server {
    listen 443 ssl;
    server_name example.com;

    ssl_certificate /etc/ssl/certs/cert.pem;
    ssl_certificate_key /etc/ssl/private/key.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
}

HTTPS redirect:

# Nginx
server {
    listen 80;
    server_name example.com;
    return 301 https://$server_name$request_uri;
}

# Apache (.htaccess or VirtualHost)
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

Competition context: Verify certificate installation with openssl s_client -connect example.com:443. Screenshot browser showing HTTPS lock icon.

---

Strong Cipher Suites

Modern cipher configuration (national+):

# Nginx - Mozilla Modern configuration
ssl_protocols TLSv1.3;
ssl_prefer_server_ciphers off;

# Nginx - Mozilla Intermediate (broader compatibility)
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;

# Apache
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
SSLHonorCipherOrder off

Test cipher strength:

nmap --script ssl-enum-ciphers -p 443 example.com

---

Security Headers

Essential headers (regional+):

# Nginx
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;

# Apache (requires mod_headers)
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-Content-Type-Options "nosniff"
Header always set X-XSS-Protection "1; mode=block"
Header always set Referrer-Policy "no-referrer-when-downgrade"

HTTP Strict Transport Security (HSTS):

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Content Security Policy (CSP) - national+:

add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';" always;

Competition context: Use browser developer tools (F12) to verify headers are present. Screenshot Network tab showing headers.

---

Information Disclosure Prevention

Hide server version:

# Nginx - nginx.conf
server_tokens off;

# Apache - httpd.conf or security.conf
ServerTokens Prod
ServerSignature Off

Disable directory listing:

# Nginx
autoindex off;

# Apache
Options -Indexes

Remove default pages:

# Apache
rm /var/www/html/index.html
rm -rf /var/www/html/icons/

# Nginx
rm /var/www/html/index.nginx-debian.html

---

Rate Limiting

Nginx rate limiting (national+):

# Define rate limit zone
limit_req_zone $binary_remote_addr zone=loginlimit:10m rate=5r/m;

# Apply to login endpoint
location /login {
    limit_req zone=loginlimit burst=5 nodelay;
    proxy_pass http://backend;
}

Apache mod_ratelimit:

<Location "/login">
    SetOutputFilter RATE_LIMIT
    SetEnv rate-limit 400
</Location>

---

Competition Strategy & Marking

What gets marked:

• HTTPS enabled and accessible
• HTTP redirects to HTTPS
• Security headers present (verify with curl/browser)
• Server version hidden
• Strong cipher suites configured

Evidence and reporting requirements:

• Browser screenshot showing HTTPS lock icon with valid certificate
• curl -I https://example.com output showing all required security headers
• openssl s_client -connect example.com:443 output showing TLS version and cipher suite
• Configuration file snippets (apache2.conf, nginx.conf) with line numbers showing changes
• nmap --script ssl-enum-ciphers -p 443 example.com output proving strong ciphers
• Browser DevTools screenshot (F12 → Network tab) showing security headers
• Test evidence showing HTTP → HTTPS redirect works (curl -L output)
• Service status showing web server running after configuration changes
• Clear naming: webserver_https_enabled.png, webserver_security_headers.png

Time allocation:

• SSL certificate deployment: 10-15 minutes
• HTTPS redirect: 5 minutes
• Security headers: 10 minutes
• Server hardening (hide version, disable indexes): 5 minutes

Time-boxed drill suggestion: 45-minute web server hardening sprint: Given an Apache or Nginx server with HTTP only, generate a self-signed certificate, enable HTTPS, configure HTTP → HTTPS redirect, add security headers (X-Frame-Options, X-Content-Type-Options, HSTS, CSP), disable server version disclosure, disable directory listing, test configuration, and document all changes with curl/openssl output and screenshots.

---

False Flags / Wrong Paths

Common Traps

Certificate path errors If cert path is wrong, Apache/Nginx won’t start. Check logs: journalctl -u apache2 or journalctl -u nginx.

Mixed content warnings After enabling HTTPS, ensure all resources (CSS, JS, images) load over HTTPS. Check browser console.

Breaking existing app Overly strict CSP can block legitimate scripts. Test app after applying headers.

---

Practice Checklist

• Can generate and install self-signed SSL certificate
• Can configure HTTPS redirect for Apache and Nginx
• Can configure strong cipher suites (TLS 1.2+)
• Can add security headers (X-Frame-Options, HSTS, CSP)
• Can hide server version information
• Can disable directory listing
• Can test SSL configuration with openssl and nmap
• Can verify headers with curl and browser dev tools

---

References

• Regional Roadmap: Infrastructure hardening
• National Roadmap: Infrastructure hardening