1

According to Guide to the Secure Configuration of Red Hat Enterprise Linux 6, there is this policy:

"In certain scenarios, it is beneficial to remove certain httpd modules to limit the functionality of the HTTP Server. To do so, simply comment out the entire line which loads the module you wish to remove in the /etc/httpd/conf/httpd.conf file".*

How should I know which modules are needed for some web application? Particularly I want to deploy MediaWiki. I searched its wiki, and didn't find such topic in its security page.

  • 2
    Well, remove them one by one and see what breaks... – Tom Leek Dec 28 '13 at 14:44
0

Unless MediaWiki's documentation details which modules are required then there is no way to know other than by trial and error... as @Tom Leek suggested, disable them one by one. This can be a little tedious and time consuming but will achieve your goal. Some of the modules should be obvious though. For example, if the system is not a proxy you don't need mod_proxy. If you don't do any URL rewriting then you don't need mod_rewrite.

Hopefully the list of Apache modules with descriptions will help narrow the field more quickly.

  • I know this is an old question but maybe it'll help somebody else at some point. – user1801810 Feb 27 '14 at 0:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.