Security hardening: disable expose_php, raise max_input_time, remove Indexes
Open
Beginner friendly
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 755
- Forks
- 128
- PR merge metrics
- No merged PRs in 30d
Description
Security hardening for server defaults.
Findings
php.inihasexpose_php = On. Best practice isOff.php.inihasmax_input_time = 60, which can abort large multipart/form-data uploads while PHP is still reading POST data. After raising upload limits to 5G, this should be increased.- Apache site config
docker/config/api.confsetsOptions Indexesfor the document root, enabling directory listings (not needed for API).
Proposed changes
- Set
expose_php = Offindocker/config/php.ini. - Set
max_input_time = 3600(or-1) indocker/config/php.ini. - Change
<Directory /var/www/openml>Optionsto removeIndexes.
Acceptance criteria
- No directory listing anywhere under DocumentRoot.
expose_phpdisabled.- Large uploads do not time out during PHP input parsing.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with docker/config/php.ini and docker/config/api.conf, reviewing the existing PHP and Apache defaults named in the issue. Verify the resulting configuration and inspect the document root behavior. Done means expose_php is disabled, max_input_time accommodates large uploads, and directory listings are unavailable under DocumentRoot.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- apache, docker, php
- Domain
- devops, infrastructure, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100