SmartPDU-Unuse/Xianglinghui/03.lib/appweb-doc/samples/secure-server/appweb.conf

#
#   appweb.conf -- Appweb Configuration for a highly secure server
#

#
#   Enable emitting debug error messages back to the client. Defaults to "off".
#   WARNING: this may disclose unwanted information. Do not enable in production releases.
#
ShowErrors off

AddHandler espHandler esp
AddHandler fileHandler

include auth.conf

#
#   Create a chroot jail. Nothing outside "." will be visible after this.
#
#   MakeDir APPWEB:APPWEB:0755 /var/spool/appweb/embedthis/cache

GroupAccount APPWEB
UserAccount APPWEB

#
#   Listen for HTTP and HTTPS
#
Listen 127.0.0.1:8080
ListenSecure 127.0.0.1:4443

#
#   Create a "chroot jail" by changing the system root directory to this
#   directory. Once changed files outside the jail will be inaccessible.
#   If rotating log files, must do Chroot before defining logs.
#
# Chroot "."

#
#   SECURITY NOTE: you must generate the key and certificate
#   The self.crt is a self-signed certificate for test purposes only.
#   You MUST get your own certificate and key.
#
SSLCertificateFile      "self.crt"
SSLCertificateKeyFile   "self.key"

#
#   Route HTTP traffic over SSL. This entire site runs over SSL.
#
Redirect secure

#
#   This will force browsers to insist on TLS connections only for one year
#
#   Strict-Transport-Security max-age=31536000; includeSubDomains

#
#   Documents directory
#
Documents "web"
DirectoryIndex index.esp

#
#   Authentication and Authorization directives
#
AuthStore config

#
#   Web-Form login (test user:password is joshua:pass1)
#
AuthType form example.com https:///pub/login.esp https:///login /logout /index.esp

#
#   Timeouts. Set as low as possible.
#   The defaults are already fairly low ... lower even more here.
#
InactivityTimeout 30secs
RequestParseTimeout 5sec
RequestTimeout 1min
SessionTimeout 5mins

#
#   Emit as little information as possible. Don't emit as "Server" header
#   This is the default
#
#   Stealth on

#
#   Set the cookie name and determine if the cookie is visible to Javascript
#   (default is httponly, invisible to scripts). Making cookies visible
#   increases the XSS potential.
#
#   SessionCookie name=NAME visible=false

#
#   Minimize cross-site vulnerabilities
#   These are emitted by default
#
#   Header set X-XSS-Protection 1; mode=block
#   Header set X-Frame-Options deny
#   Header set X-Content-Type-Options: nosniff

#
#   You should seriously consider adding a content security policy to minimize XSS vulnerabilities
#
#   Header set Content-Security-Policy default-src 'self'

#
#   Monitors and defenses
#   These will ban clients that probe the server and trigger too many not-found errors.
#   Also any client doing more than 500 requests in a 30 sec period will be banned.
#   Bans are for 10 minutes.
#
Defense deny REMEDY=ban PERIOD=10mins
Monitor "NotFoundErrors > 190" 30sec deny
Monitor "Requests > 500" 30sec deny

#
#   Sandbox limits. Set as low as possible.
#
LimitCache 256K
LimitCacheItem 80K
LimitClients 10
LimitConnectionsPerClient 20
LimitRequestsPerClient 20
LimitRequestBody 100K
LimitRequestForm 32K
LimitUri 512

#
#   Cache static content for one day at the client
#
Cache client=1day extensions="html,gif,jpeg,jpg,png,pdf,ico,js"

LimitWorkers 4

#
#   Restart the server if memory is depleted
#
LimitMemory 8MB
MemoryPolicy restart