Step 1: Installing Apache

To install Apache, you’ll first need to add the EPEL repository to your system. This can be done with the following command:

$ sudo dnf install epel-release 

Next, you can install Apache using the following command:
$ sudo dnf install httpd 

Once the installation is complete, you can start Apache with the following command:
$ sudo systemctl start httpd 

To ensure that Apache starts automatically at boot time, run the following command:
$ sudo systemctl enable httpd 

Step 2: Testing the Installation

To test the installation, open a web browser and navigate to `http://your-server-ip`. You should see a page that says “Welcome to your Apache Web Server”. This confirms that Apache is up and running on your system.

Step 3: Securing Apache

Now that Apache is installed, it’s time to secure it for production use. Here are some key steps to follow:
1. Update Apache to the latest version
It’s important to keep your Apache installation up to date in order to take advantage of security fixes and other improvements. You can update Apache using the following command:
$ sudo dnf update httpd
    
2. Disable directory listing

By default, Apache will display a directory listing if no index file is present in a directory. This can be a security risk, so it’s best to disable directory listing. You can do this by adding the following lines to the Apache configuration file located at /etc/httpd/conf/httpd.conf:

<Directory /var/www/html>
Options -Indexes
</Directory>

3. Configure a firewall

A firewall can help protect your server from unauthorized access by blocking incoming traffic on certain ports. On RHEL & CentOS Stream 9 , you can use the built-in firewall service, firewalld, to control incoming traffic. To allow traffic to Apache, run the following command:
$ sudo firewall-cmd --permanent --add-service=http 
$ sudo firewall-cmd --reload 

4. Enable SSL/TLS encryption

In order to encrypt data transmitted between the server and clients, you should enable SSL/TLS encryption. This can be done by obtaining an SSL certificate and configuring Apache to use it. A self-signed certificate can be created using the following command:
$ sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/apache.key -out /etc/ssl/certs/apache.crt 

Next, you need to configure Apache to use the certificate. This can be done by adding the following lines to the Apache configuration file located at /etc/httpd/conf/httpd.conf:

<VirtualHost _default_:443>
    DocumentRoot "/var/www/html"
    ServerName your-server-name

    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/apache.crt
    SSLCertificateKeyFile /etc/ssl/private/apache.key

    <Directory "/var/www/html">
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
    </Directory>
</VirtualHost>
	
Restart Apache after making these changes using the following command:
$ sudo systemctl restart httpd 

5. Limit access to sensitive files

It’s important to limit access to sensitive files such as configuration files and logs. You can do this by adding the following lines to the Apache configuration file located at /etc/httpd/conf/httpd.conf:

<FilesMatch "\.(log|cfg)$">
    Require all denied
</FilesMatch>

