From 1d2c19d8409ad53bb5ca7bf180f433f05af91afe Mon Sep 17 00:00:00 2001
From: Jean-Philippe Evrard <jean-philippe.evrard@belnet.be>
Date: Wed, 19 Aug 2015 14:19:32 +0200
Subject: [PATCH] Apache servers will not reporting version anymore

In order to make it more difficult to know which
httpd server is running, here is a change to
reduce the ServerTokens OS to ServerTokens Prod
and the ServerSignature On to ServerSignature Off.

This removes ServerName and version report
on page footer and reduces the detail of the httpd
server running in the headers to "Apache".

These options can be overwritten by an user variable

Change-Id: I1aaffaa3b6b7d6574aefac65b6027e62240a702b
Closes-Bug: #1484256
---
 playbooks/roles/os_horizon/defaults/main.yml  |  2 ++
 .../roles/os_horizon/tasks/horizon_apache.yml | 18 +++++++++++++++++
 playbooks/roles/os_keystone/defaults/main.yml |  2 ++
 .../os_keystone/tasks/keystone_apache.yml     | 20 +++++++++++++++++++
 4 files changed, 42 insertions(+)

diff --git a/playbooks/roles/os_horizon/defaults/main.yml b/playbooks/roles/os_horizon/defaults/main.yml
index ec3e54b24b..df6574e1dd 100644
--- a/playbooks/roles/os_horizon/defaults/main.yml
+++ b/playbooks/roles/os_horizon/defaults/main.yml
@@ -49,6 +49,8 @@ horizon_lib_dir: /usr/local/lib/python2.7/dist-packages
 horizon_endpoint_type: internalURL
 
 horizon_server_name: "horizon"
+horizon_apache_servertokens: "Prod"
+horizon_apache_serversignature: "Off"
 horizon_log_level: info
 horizon_dropdown_max_items: 30
 horizon_time_zone: UTC
diff --git a/playbooks/roles/os_horizon/tasks/horizon_apache.yml b/playbooks/roles/os_horizon/tasks/horizon_apache.yml
index a9a331d465..b26b306df5 100644
--- a/playbooks/roles/os_horizon/tasks/horizon_apache.yml
+++ b/playbooks/roles/os_horizon/tasks/horizon_apache.yml
@@ -63,3 +63,21 @@
   notify: Restart apache2
   tags:
     - horizon-apache-config
+
+- name: Ensure Apache ServerTokens
+  lineinfile:
+    dest: "/etc/apache2/conf-available/security.conf"
+    regexp: '^ServerTokens'
+    line: "ServerTokens {{ horizon_apache_servertokens }}"
+  notify: Restart apache2
+  tags:
+    - horizon-apache-config
+
+- name: Ensure Apache ServerSignature
+  lineinfile:
+    dest: "/etc/apache2/conf-available/security.conf"
+    regexp: '^ServerSignature'
+    line: "ServerSignature {{ horizon_apache_serversignature }}"
+  notify: Restart apache2
+  tags:
+    - horizon-apache-config
diff --git a/playbooks/roles/os_keystone/defaults/main.yml b/playbooks/roles/os_keystone/defaults/main.yml
index 8264829ead..e042354277 100644
--- a/playbooks/roles/os_keystone/defaults/main.yml
+++ b/playbooks/roles/os_keystone/defaults/main.yml
@@ -124,6 +124,8 @@ keystone_service_adminurl: "{{ keystone_service_adminurl_v3 }}"
 
 ## Apache setup
 keystone_apache_log_level: info
+keystone_apache_servertokens: "Prod"
+keystone_apache_serversignature: "Off"
 keystone_wsgi_threads: "{{ ansible_processor_vcpus | default(2) // 2 }}"
 keystone_wsgi_processes: "{{ ansible_processor_vcpus | default(1) }}"
 
diff --git a/playbooks/roles/os_keystone/tasks/keystone_apache.yml b/playbooks/roles/os_keystone/tasks/keystone_apache.yml
index 1f25d01154..5576d127ab 100644
--- a/playbooks/roles/os_keystone/tasks/keystone_apache.yml
+++ b/playbooks/roles/os_keystone/tasks/keystone_apache.yml
@@ -57,6 +57,26 @@
   tags:
     - keystone-httpd
 
+- name: Ensure Apache ServerTokens
+  lineinfile:
+    dest: "/etc/apache2/conf-available/security.conf"
+    regexp: '^ServerTokens'
+    line: "ServerTokens {{ keystone_apache_servertokens }}"
+  notify:
+    - Restart Apache
+  tags:
+    - keystone-httpd
+
+- name: Ensure Apache ServerSignature
+  lineinfile:
+    dest: "/etc/apache2/conf-available/security.conf"
+    regexp: '^ServerSignature'
+    line: "ServerSignature {{ keystone_apache_serversignature }}"
+  notify:
+    - Restart Apache
+  tags:
+    - keystone-httpd
+
 - name: Enable/disable mod_ssl for apache2
   apache2_module:
     name: ssl