Headers warnings in new Nextcloud 11.1

🚧 Installation
1

Machine:

  • Jessie (64)
  • Apache/2.4.10
  • PHP Zend OPcache v7.0.6-dev
  • MySQL Ver 14.14 Distrib 5.5.54
  • Dedicated SSL cert (LetsEncrypt)

The installation was fairly smooth and everything seams to work fine but in the admin page I am still presented with some warnings:

    **Security & setup warnings**
    The "X-XSS-Protection" HTTP header is not configured to equal to "1; mode=block". This is a potential security or privacy risk and we recommend adjusting this setting.
    The "X-Content-Type-Options" HTTP header is not configured to equal to "nosniff". This is a potential security or privacy risk and we recommend adjusting this setting.
    The "X-Robots-Tag" HTTP header is not configured to equal to "none". This is a potential security or privacy risk and we recommend adjusting this setting.
    The "X-Frame-Options" HTTP header is not configured to equal to "SAMEORIGIN". This is a potential security or privacy risk and we recommend adjusting this setting.
    The "X-Download-Options" HTTP header is not configured to equal to "noopen". This is a potential security or privacy risk and we recommend adjusting this setting.
    The "X-Permitted-Cross-Domain-Policies" HTTP header is not configured to equal to "none". This is a potential security or privacy risk and we recommend adjusting this setting.

I checked the .htaccess and those values are set: (no editing done)

   <IfModule mod_headers.c>
   <IfModule mod_setenvif.c>
     <IfModule mod_fcgid.c>
          SetEnvIfNoCase ^Authorization$ "(.+)" XAUTHORIZATION=$1
          RequestHeader set XAuthorization %{XAUTHORIZATION}e env=XAUTHORIZATION
    </IfModule>
    <IfModule mod_proxy_fcgi.c>
       SetEnvIfNoCase Authorization "(.+)" HTTP_AUTHORIZATION=$1
    </IfModule>
  </IfModule>

  <IfModule mod_env.c>
    # Add security and privacy related headers
    Header set X-Content-Type-Options "nosniff"
    Header set X-XSS-Protection "1; mode=block"
    Header set X-Robots-Tag "none"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set X-Download-Options "noopen"
    Header set X-Permitted-Cross-Domain-Policies "none"
    SetEnv modHeadersAvailable true
  </IfModule>

I checked to make sure the modules required are loaded: (yes, recent server restart)

sudo apachectl -M
Loaded Modules:
 core_module (static)
 so_module (static)
 watchdog_module (static)
 http_module (static)
 log_config_module (static)
 logio_module (static)
 version_module (static)
 unixd_module (static)
 access_compat_module (shared)
 alias_module (shared)
 auth_basic_module (shared)
 authn_core_module (shared)
 authn_file_module (shared)
 authz_core_module (shared)
 authz_host_module (shared)
 authz_user_module (shared)
 autoindex_module (shared)
 cache_module (shared)
 deflate_module (shared)
 dir_module (shared)
 env_module (shared)
 filter_module (shared)
 headers_module (shared)
 mime_module (shared)
 mpm_prefork_module (shared)
 negotiation_module (shared)
 pagespeed_module (shared)
 php5_module (shared)
 rewrite_module (shared)
 setenvif_module (shared)
 socache_shmcb_module (shared)
 ssl_module (shared)
 status_module (shared)

There are no warnings in the log file. Where do I look to troubleshoot these issues?
Any clues?

Thanks

2

Have you verified the headers are being set? Try this,

curl -I https://yourdomain.ext

That should show you which headers are being set.

3

If they are not set, check if mod_env is installed and enabled. You use a shared hosting as I read in other topic? Ask your webhost about it.

You can also check by yourself about enabled modules and many other things by creating a php-file in your directory with <?php phpinfo(); ?> as content and open it.

Also your system needs to be configured to use the .htaccess files, by having

  <Directory /path/to/nextcloud/>
  		...
  		AllowOverride All
                ...
  </Directory>

in related vhost/apache config.

You can check, if .htaccess is used by rust writing some random rubbish line into it. If nextcloud fails to load completely (forgot the related browser error), then .htaccess seems to be used ;).

4

@MichaIng This answer worked perfectly. Now all security checks pass.
Cheers

5

Great to hear :slight_smile:, which one was it, mod_env or AllowOverride All or both?

6

mod_env was already installed and working. I needed to add AllowOverride All in the virtual host file