1.Apache2のインストールとセキュアな設定

Raspberry PiにApache2をインストールして、最低限のセキュリティ設定をします。

Apache2のインストール
1. module_headersの活性化
2. rewriteの活性化
セキュアな設定

Apache2のインストール

下記のコマンドでApache2をインストールします。

$ sudo apt-get -y install apache2
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
  apache2-bin apache2-data apache2-utils libapr1t64 libaprutil1-dbd-sqlite3 libaprutil1-ldap libaprutil1t64 liblua5.4-0 ssl-cert
Suggested packages:
  apache2-doc apache2-suexec-pristine | apache2-suexec-custom ufw www-browser
The following NEW packages will be installed:
  apache2 apache2-bin apache2-data apache2-utils libapr1t64 libaprutil1-dbd-sqlite3 libaprutil1-ldap libaprutil1t64 liblua5.4-0 ssl-cert
0 upgraded, 10 newly installed, 0 to remove and 0 not upgraded.
Need to get 2,264 kB of archives.
After this operation, 14.4 MB of additional disk space will be used.
Get:1 http://deb.debian.org/debian trixie/main arm64 libapr1t64 arm64 1.7.5-1 [97.1 kB]
Get:2 http://deb.debian.org/debian trixie/main arm64 libaprutil1t64 arm64 1.6.3-3+b1 [86.2 kB]
Get:3 http://deb.debian.org/debian trixie/main arm64 libaprutil1-dbd-sqlite3 arm64 1.6.3-3+b1 [14.2 kB]
Get:4 http://deb.debian.org/debian trixie/main arm64 libaprutil1-ldap arm64 1.6.3-3+b1 [12.4 kB]
Get:5 http://deb.debian.org/debian trixie/main arm64 liblua5.4-0 arm64 5.4.7-1+b2 [134 kB]
Get:6 http://deb.debian.org/debian-security trixie-security/main arm64 apache2-bin arm64 2.4.67-1~deb13u3 [1,302 kB]
Get:7 http://deb.debian.org/debian-security trixie-security/main arm64 apache2-data all 2.4.67-1~deb13u3 [160 kB]
Get:8 http://deb.debian.org/debian-security trixie-security/main arm64 apache2-utils arm64 2.4.67-1~deb13u3 [215 kB]
Get:9 http://deb.debian.org/debian-security trixie-security/main arm64 apache2 arm64 2.4.67-1~deb13u3 [226 kB]
Get:10 http://deb.debian.org/debian trixie/main arm64 ssl-cert all 1.1.3 [16.8 kB]
Fetched 2,264 kB in 0s (12.9 MB/s)
Preconfiguring packages ...
Selecting previously unselected package libapr1t64:arm64.
(Reading database ... 69011 files and directories currently installed.)
Preparing to unpack .../0-libapr1t64_1.7.5-1_arm64.deb ...
Unpacking libapr1t64:arm64 (1.7.5-1) ...
Selecting previously unselected package libaprutil1t64:arm64.
Preparing to unpack .../1-libaprutil1t64_1.6.3-3+b1_arm64.deb ...
Unpacking libaprutil1t64:arm64 (1.6.3-3+b1) ...
Selecting previously unselected package libaprutil1-dbd-sqlite3:arm64.
Preparing to unpack .../2-libaprutil1-dbd-sqlite3_1.6.3-3+b1_arm64.deb ...
Unpacking libaprutil1-dbd-sqlite3:arm64 (1.6.3-3+b1) ...
Selecting previously unselected package libaprutil1-ldap:arm64.
Preparing to unpack .../3-libaprutil1-ldap_1.6.3-3+b1_arm64.deb ...
Unpacking libaprutil1-ldap:arm64 (1.6.3-3+b1) ...
Selecting previously unselected package liblua5.4-0:arm64.
Preparing to unpack .../4-liblua5.4-0_5.4.7-1+b2_arm64.deb ...
Unpacking liblua5.4-0:arm64 (5.4.7-1+b2) ...
Selecting previously unselected package apache2-bin.
Preparing to unpack .../5-apache2-bin_2.4.67-1~deb13u3_arm64.deb ...
Unpacking apache2-bin (2.4.67-1~deb13u3) ...
Selecting previously unselected package apache2-data.
Preparing to unpack .../6-apache2-data_2.4.67-1~deb13u3_all.deb ...
Unpacking apache2-data (2.4.67-1~deb13u3) ...
Selecting previously unselected package apache2-utils.
Preparing to unpack .../7-apache2-utils_2.4.67-1~deb13u3_arm64.deb ...
Unpacking apache2-utils (2.4.67-1~deb13u3) ...
Selecting previously unselected package apache2.
Preparing to unpack .../8-apache2_2.4.67-1~deb13u3_arm64.deb ...
Unpacking apache2 (2.4.67-1~deb13u3) ...
Selecting previously unselected package ssl-cert.
Preparing to unpack .../9-ssl-cert_1.1.3_all.deb ...
Unpacking ssl-cert (1.1.3) ...
Setting up ssl-cert (1.1.3) ...
Setting up libapr1t64:arm64 (1.7.5-1) ...
Setting up liblua5.4-0:arm64 (5.4.7-1+b2) ...
Setting up apache2-data (2.4.67-1~deb13u3) ...
Setting up libaprutil1t64:arm64 (1.6.3-3+b1) ...
Setting up libaprutil1-ldap:arm64 (1.6.3-3+b1) ...
Setting up libaprutil1-dbd-sqlite3:arm64 (1.6.3-3+b1) ...
Setting up apache2-utils (2.4.67-1~deb13u3) ...
Setting up apache2-bin (2.4.67-1~deb13u3) ...
Setting up apache2 (2.4.67-1~deb13u3) ...
Enabling module mpm_event.
Enabling module authz_core.
Enabling module authz_host.
Enabling module authn_core.
Enabling module auth_basic.
Enabling module access_compat.
Enabling module authn_file.
Enabling module authz_user.
Enabling module alias.
Enabling module dir.
Enabling module autoindex.
Enabling module env.
Enabling module mime.
Enabling module negotiation.
Enabling module setenvif.
Enabling module filter.
Enabling module deflate.
Enabling module status.
Enabling module reqtimeout.
Enabling conf charset.
Enabling conf localized-error-pages.
Enabling conf other-vhosts-access-log.
Enabling conf security.
Enabling conf serve-cgi-bin.
Enabling site 000-default.
Created symlink '/etc/systemd/system/multi-user.target.wants/apache2.service' → '/usr/lib/systemd/system/apache2.service'.
Created symlink '/etc/systemd/system/multi-user.target.wants/apache-htcacheclean.service' → '/usr/lib/systemd/system/apache-htcacheclean.service'.
Processing triggers for man-db (2.13.1-1) ...
Processing triggers for libc-bin (2.41-12+rpt1+deb13u3) ...

念のためインストールされたApache2を確認します。

$ apachectl -v
Server version: Apache/2.4.67 (Debian)
Server built:   2026-06-05T10:55:53

module_headersの活性化

HTTP のリクエストヘッダと応答ヘッダを制御し、追加・変更・削除します。

セキュリティ対策の為必須です。

$ sudo a2enmod headers
Enabling module headers.
To activate the new configuration, you need to run:
  systemctl restart apache2

rewriteの活性化

アクセスのあったURLを、正規表現で書き換えてから処理する機能です。

書き換えで対処できることが一杯あるので有効にします。

$ sudo a2enmod rewrite
Enabling module rewrite.
To activate the new configuration, you need to run:
  systemctl restart apache2

セキュアな設定

有効と思われる全てのセキュアな設定を行っていきます。

インストール直後のHTTPヘッダの確認

インストール直後は下記の青い部分がHTTPヘッダとして出力されます。

$ curl -v  http://localhost | more
* Host localhost:80 was resolved.
* IPv6: ::1
* IPv4: 127.0.0.1
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 127.0.0.1:80...
* Connected to localhost (127.0.0.1) port 80
* using HTTP/1.x
> GET / HTTP/1.1
> Host: localhost
> User-Agent: curl/8.14.1
> Accept: */*
>
* Request completely sent off
< HTTP/1.1 200 OK
< Date: Sat, 11 Jul 2026 11:08:16 GMT
< Server: Apache/2.4.67 (Debian)
< Last-Modified: Sat, 11 Jul 2026 11:05:57 GMT
< ETag: "29cf-65653d77e36ea"
< Accept-Ranges: bytes
< Content-Length: 10703
< Vary: Accept-Encoding
< Content-Type: text/html
<
{ [10703 bytes data]

100 10703  100 10703    0     0  2812k      0 --:--:-- --:--:-- --:-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
-:-- 3484k
<html xmlns="http://www.w3.org/1999/xhtml">
* Connection #0 to host localhost left intact
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <title>Apache2 Debian Default Page: It works</title>
    <style type="text/css" media="screen">
・
・
・

セキュアな設定

Apache2からできるセキュリティ対策を設定します。

$ sudo vi /etc/apache2/conf-enabled/security.conf

ももぶろ

viの超簡単な使い方は、ここを見てね

下記の赤い値に変更してください。

無い行は追加をしてください。

行の頭に#が入っている行はコメントなので、コメントは追加する必要はありません。

設定の説明がコメントにあるので参考にしてください。

# Changing the following options will not really affect the security of the
# server, but might make attacks slightly more difficult in some cases.
<Directory />
   AllowOverride None
   Require all denied
</Directory>
#
# ServerTokens
# This directive configures what you return as the Server HTTP response
# Header. The default is 'Full' which sends information about the OS-Type
# and compiled in modules.
# Set to one of:  Full | OS | Minimal | Minor | Major | Prod
# where Full conveys the most information, and Prod the least.
#ServerTokens Minimal
ServerTokens Prod
#ServerTokens Full

#
# Optionally add a line containing the server version and virtual host
# name to server-generated pages (internal error documents, FTP directory
# listings, mod_status and mod_info output etc., but not CGI generated
# documents or custom error documents).
# Set to "EMail" to also include a mailto: link to the ServerAdmin.
# Set to one of:  On | Off | EMail
#ServerSignature Off
ServerSignature Off

#
# Allow TRACE method
#
# Set to "extended" to also reflect the request body (only for testing and
# diagnostic purposes).
#
# Set to one of:  On | Off | extended
TraceEnable Off
#TraceEnable On

#
# Forbid access to version control directories
#
# If you use version control systems in your document root, you should
# probably deny access to their directories.
#
# Examples:
#
#RedirectMatch 404 /\.git
#RedirectMatch 404 /\.svn

#
# Setting this header will prevent MSIE from interpreting files as something
# else than declared by the content type in the HTTP headers.
# Requires mod_headers to be enabled.
#
Header set X-Content-Type-Options: "nosniff"

#
# Setting this header will prevent other sites from embedding pages from this
# site as frames. This defends against clickjacking attacks.
# Requires mod_headers to be enabled.
#
Header set Content-Security-Policy "frame-ancestors 'self';"
#
# Setting this header will prevent other sites from embedding pages from this
# site as frames. This defends against clickjacking attacks.
# Requires mod_headers to be enabled.
#
Header set X-Frame-Options: "sameorigin"

# バージョン情報の隠蔽
Header unset "X-Powered-By"

# XSS対策
Header set X-XSS-Protection "1; mode=block"

Apache2のサーバを再起動

$ sudo systemctl restart apache2.service

メッセージは何も出ません。

メッセージが出力されてるときは、エラーが有るのでしっかり対処しましょう。

セキュリティ設定後のHTTPヘッダの確認

変わったところは赤字にしています。


$ curl -v http://localhost | more
* Host localhost:80 was resolved.
* IPv6: ::1
* IPv4: 127.0.0.1
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 127.0.0.1:80...
* Connected to localhost (127.0.0.1) port 80
* using HTTP/1.x
> GET / HTTP/1.1
> Host: localhost
> User-Agent: curl/8.14.1
> Accept: */*
>
* Request completely sent off
< HTTP/1.1 200 OK
< Date: Sat, 11 Jul 2026 11:14:38 GMT
< Server: Apache
< Last-Modified: Sat, 11 Jul 2026 11:05:57 GMT
< ETag: "29cf-65653d77e36ea"
< Accept-Ranges: bytes
< Content-Length: 10703
< Vary: Accept-Encoding
< X-Content-Type-Options: nosniff
< Content-Security-Policy: frame-ancestors 'self';
< X-Frame-Options: sameorigin
< X-XSS-Protection: 1; mode=block
< Content-Type: text/html
<
{ [10703 bytes data]
100 10703  100 10703
0     0  2097k      0 --:--:-- --:--:-- --:--:-- 2613k
* Connection #0 to host localhost left intact
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <title>Apache2 Debian Default Page: It works</title>
    <style type="text/css" media="screen">
  * {
    margin: 0px 0px 0px 0px;
    padding: 0px 0px 0px 0px;
  }
・
・
・

ももぶろ

Apache2のインストールはこれで終了です。