Bug 1408484

Summary: sudo yum install ngx_headers_more fails
Product: [Fedora] Fedora EPEL Reporter: Geoffrey Hoffman <geoffrey.hoffman>
Component: nginxAssignee: Felix Kaechele <felix>
Status: CLOSED WONTFIX QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: epel7CC: affix, athmanem, bperkins, ciapnz, jeremy, jkaluza, jochen.gruber, jtate, pavel.lisy, simon, wtogami
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-04-21 14:27:28 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Geoffrey Hoffman 2016-12-23 17:18:18 UTC
Description of problem:

A routine security audit revealed the presence of "Server: nginx" in the HTTP response headers when serving content from RedHat/CentOS using the popular web browser, Nginx. 

For security reasons, it is recommended, if not required, to change or remove this header. 

ngx_headers_more module provides this feature, however, installation currently requires compiling nginx from source, though a dynamic module load option is available.

It is requested to add the ngx_headers_more module to yum installation in EPEL repository. Debian-based systems feature this module via 

apt-get install nginx-extras

Version-Release number of selected component (if applicable):

Nginx version 1.10.x

How reproducible:

Steps to Reproduce:
1.yum search nginx | grep more

Actual results:
No package available for ngx_headers_more

Expected results:
Installation of ngx_headers_more module by yum

Additional info:


$ sudo yum install nginx-extras
Loaded plugins: amazon-id, rhui-lb, search-disabled-repos
No package nginx-extras available.
Error: Nothing to do
$ sudo yum -y install epel-release
Loaded plugins: amazon-id, rhui-lb, search-disabled-repos
Package epel-release-7-8.noarch already installed and latest version
Nothing to do
$ sudo yum search nginx | grep headers

Comment 1 Danila Vershinin 2019-11-20 21:56:04 UTC
Hoping not to sound much biased about this (maintainer of GetPageSpeed repos here):

Your options for up-to-date packaged ngx_headers_more (in lack of such in EPEL now) are such:

* Commercial NGINX Plus subscription (hefty fees)
* GetPageSpeed repository (a ten-dollar bill, continuously maintained and updated - both stable and mainline NGINX can be chosen, 30+ NGINX modules continuously rebuilt with every NGINX release and can be installed separately. Includes modules that are not available in NGINX Plus. So it's NGINX Plus+ :)
* AFAIK, the author of ngx_headers_more has its own repository/NGINX builds (but named differently/installed separately from NGINX, so it *might* have SELinux adjustments required)

Comment 2 Felix Kaechele 2020-05-17 03:04:43 UTC
*** Bug 1518974 has been marked as a duplicate of this bug. ***

Comment 3 Felix Kaechele 2021-04-21 14:27:28 UTC
I have decided to not include 3rd party source code in the nginx package build process.
I do, however, have enabled the --with-compat build flag in the nginx package, so it should be easy for people to build separate packages with the dynamic module.