Hide PHP Version
April 10, 2009
To hide the PHP version from HTTP responses, edit /etc/php.ini and change:
|
1 |
expose_php = On |
to:
|
1 |
expose_php = Off |
Then restart apache.
To hide the PHP version from HTTP responses, edit /etc/php.ini and change:
|
1 |
expose_php = On |
to:
|
1 |
expose_php = Off |
Then restart apache.
For a recent PCI audit remediation project I had to assemble a list of recent CVEs that were resolved via backports in httpd-2.2.3-22 on RHEL5. Here’s the list: https://rhn.redhat.com/errata/RHSA-2008-0008.html CVE-2008-0005 CVE-2007-6422 CVE-2007-6421 CVE-2007-6388 CVE-2007-5000 CVE-2007-4465 https://rhn.redhat.com/errata/RHSA-2008-0967.html CVE-2008-2364 https://rhn.redhat.com/errata/RHSA-2007-0746.html CVE-2007-3847 https://rhn.redhat.com/errata/RHSA-2007-0556.html CVE-2006-5752 CVE-2007-3304 CVE-2007-1863 http://kbase.redhat.com/faq/docs/DOC-9182 CVE-2006-3747 https://rhn.redhat.com/errata/RHSA-2006-0159.html CVE-2005-3357 CVE-2005-3352
Create a file at /etc/httpd/conf.d/deflate.conf with the following contents:
|
1 2 3 4 5 6 7 8 9 10 11 12 |
SetOutputFilter DEFLATE # Don't compress picture files SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png)$ \ no-gzip dont-vary # Don't compress compressed files SetEnvIfNoCase Request_URI \.(?:exe|t?gz|zip|bz2|sit|rar)$ \no-gzip dont-vary # Don't compress pdf's SetEnvIfNoCase Request_URI \.pdf$ no-gzip dont-vary |
Determine the “max process size”:
|
1 |
ps -ylChttpd --sort=rss |less |
will give output like:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 |
S UID PID PPID C PRI NI RSS SZ WCHAN TTY TIME CMD S 48 21481 20626 0 75 0 9028 75762 semtim ? 00:00:01 httpd S 48 21487 20626 0 75 0 9040 75762 semtim ? 00:00:01 httpd S 48 21482 20626 0 75 0 9064 75762 semtim ? 00:00:01 httpd S 48 21486 20626 0 75 0 9088 75762 semtim ? 00:00:01 httpd S 48 21485 20626 0 75 0 9096 75762 semtim ? 00:00:00 httpd S 48 21488 20626 0 75 0 9104 75762 semtim ? 00:00:01 httpd S 48 21017 20626 0 75 0 9116 75762 semtim ? 00:00:02 httpd S 48 21019 20626 0 75 0 9168 75762 semtim ? 00:00:01 httpd S 48 20645 20626 0 75 0 9188 75762 semtim ? 00:00:03 httpd S 48 20703 20626 0 75 0 9304 75795 semtim ? 00:00:02 httpd S 48 20628 20626 0 75 0 9324 75795 semtim ? 00:00:02 httpd S 48 20629 20626 0 75 0 9376 75829 - ? 00:00:02 httpd S 48 20630 20626 0 75 0 9408 75829 semtim ? 00:00:01 httpd S 48 20633 20626 0 75 0 9412 75829 semtim ? 00:00:02 httpd S 48 20634 20626 0 75 0 9432 75829 - ? 00:00:02 httpd S 48 20631 20626 0 75 0 9448 75829 semtim ? 00:00:01 httpd S 48 20632 20626 0 75 0 9692 75800 semtim ? 00:00:02 httpd S 48 20704 20626 0 75 0 9788 75795 semtim ? 00:00:02 httpd S 48 20635 20626 0 75 0 10016 75964 semtim ? 00:00:02 httpd S 48 20705 20626 0 75 0 10040 75964 semtim ? 00:00:03 httpd S 0 20626 1 0 78 0 14768 75729 - ? 00:00:00 httpd |
Use the largest value in the RSS column. In this case 14768. The number is in KB of memory. Determine MaxClients by dividing the available memory by the max process size. Keep in mind that MySQL and other applications may need some memory. Here’s a one liner to get max per process usage:
|
1 |
ps -ylChttpd --sort=rss | cut -f 16 -d " " | grep -v RSS | sort -n -r | head -1 |
Here’s the openssl command to convert an SSL cert/key from PK12 (windows) to PEM format:
|
1 2 3 |
openssl pkcs12 -in cert.pfx -out cert.pem -nodes |
Reliable Penguin provides managed web hosting, systems administration, website and server migrations, and expert consulting.
Submit the form—or for immediate service call 866-649-7984.