Security remove webserver identification

playbooks/roles/nginx/tasks/main.yml

@@ -81,10 +81,10 @@
   tags:
     - install
     - install:system-requirements
-
+# Use the nginx-extras package for headers-more-nginx-module support
 - name: Install the nginx package
   apt:
-    name: nginx
+    name: nginx-extras
     state: latest
     update_cache: yes
   notify: restart nginx

playbooks/roles/nginx/templates/edx/app/nginx/sites-available/cms.j2

@@ -42,9 +42,12 @@ error_page {{ k }} {{ v }};
 
   {% if NGINX_ENABLE_SSL or NGINX_REDIRECT_TO_HTTPS %}
   # request the browser to use SSL for all connections
-  add_header Strict-Transport-Security "max-age={{ NGINX_HSTS_MAX_AGE }}";
+  add_header Strict-Transport-Security "max-age={{ NGINX_HSTS_MAX_AGE }}; includeSubDomains";
   {% endif %}
 
+  # prevent the browser from doing MIME-type sniffing
+  add_header X-Content-Type-Options nosniff;
+
   # Prevent invalid display courseware in IE 10+ with high privacy settings
   add_header P3P '{{ NGINX_P3P_MESSAGE }}';
 

playbooks/roles/nginx/templates/edx/app/nginx/sites-available/lms.j2

@@ -90,9 +90,12 @@ error_page {{ k }} {{ v }};
 
   {% if NGINX_ENABLE_SSL or NGINX_REDIRECT_TO_HTTPS %}
   # request the browser to use SSL for all connections
-  add_header Strict-Transport-Security "max-age={{ NGINX_HSTS_MAX_AGE }}";
+  add_header Strict-Transport-Security "max-age={{ NGINX_HSTS_MAX_AGE }}; includeSubDomains";
   {% endif %}
 
+  # prevent the browser from doing MIME-type sniffing
+  add_header X-Content-Type-Options nosniff;
+
   # Prevent invalid display courseware in IE 10+ with high privacy settings
   add_header P3P '{{ NGINX_P3P_MESSAGE }}';
 

playbooks/roles/nginx/templates/etc/nginx/nginx.conf.j2

@@ -21,6 +21,10 @@ http {
         # increase header buffer for for https://edx-wiki.atlassian.net/browse/LMS-467&gt
         # see http://orensol.com/2009/01/18/nginx-and-weird-400-bad-request-responses/
         large_client_header_buffers 4 16k;
+
+        # Remove server info for security
+        more_clear_headers 'Server';
+        more_clear_headers 'X-Powered-By';
         # server_tokens off;
 
         # server_names_hash_bucket_size 64;