One of my favorite things about being a Linux admin is the ability to specify how things are going to be executed on the servers. I’ve been running the Apache web server for over 10 years now (1997), so setting up a new environment is no big deal, but I wanted to take it farther and cut as much out of a base install as possible, which still having it do what I need. I started with a Google search and a blank file for my httpd.conf, and went from there. Some background, since this is a work project I have a few restraints. First, we’re running on Red Hat Enterprise Server 4 with some pretty beefy hardware. Also, currently we ARE NOT building from source (something I usually do on my own Apache instances) since we’re still working out support options, which limits what we can do down to the almighty httpd.conf. I’ve trimmed down my conf at home, but since we have a smaller and more specific set of tasks for Apache here, I wanted to trim it down to the bone. So far I’ve gone through the Apache Security site, where I found their chapter on Installation and configuration especially helpful. I followed their suggestion of starting httpd.conf as a blank file. Later I ran my newly created conf through an Apache 2.0 Hardening Guide, and even combed through the Apache HTTP Server Module guide to be sure I wasn’t using anything extraneous. Now I’m being a bit idealistic with this config I know, but again, it’s for a specific purpose, and I don’t need to worry about many other factors that would cloud the waters as far as providing more options. I’ve taken out any specific modules that need to be loaded as part of my work so as not to confuse things, but I’ve left in our token variables (those that start with a T_) that get substituted just before install, so the question is, is there anything else I could cut back on? Also, is there anything missing that could lock things down further that don’t need to be installed separately? (ie- I’m not going to be installing mod_security…yet, but I’d like to). Read on to see my current ‘locked down’ config, all suggestions and (constructive?) criticisms appreciated.