弱點掃瞄解決

ubuntu 18.04下

檢測有無隱藏資訊
curl -L -I www.hdes.chc.edu.tw  

檢測ssl
https://foundeo.com/products/iis-weak-ssl-ciphers/test.cfm


藏資訊
修改  /etc/apache2/conf-enabled/security.conf 
ServerTokens = Prod
ServerSignature = off

修改 /etc/php/7.3/apache/php.ini
expose_php = Off



弱點：
TLS 1.0 enabled
sudo vim /etc/apache2/mods-available/ssl.conf
#SSLProtocol all -SSLv3
改為   SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 

若有申請 letsencrypt SSL憑證，請修改
sudo vim /etc/letsencrypt/options-ssl-apache.conf

Cookie(s) without HttpOnly flag set,without Secure flag set 
sudo vim /etc/apache2/apache2.conf
加一行 Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure

X-Frame-Options header missing
sudo vim /etc/apache2/apache2.conf

加一行 Header always append X-Frame-Options DENY

Directory traversal 
https://hostadvice.com/how-to/how-to-setup-modsecurity-for-apache-on-ubuntu-18-04/