Description of problem: A routine security audit revealed the presence of "Server: nginx" in the HTTP response headers when serving content from RedHat/CentOS using the popular web browser, Nginx. For security reasons, it is recommended, if not required, to change or remove this header. ngx_headers_more module provides this feature, however, installation currently requires compiling nginx from source, though a dynamic module load option is available. It is requested to add the ngx_headers_more module to yum installation in EPEL repository. Debian-based systems feature this module via apt-get install nginx-extras Version-Release number of selected component (if applicable): Nginx version 1.10.x How reproducible: Steps to Reproduce: 1.yum search nginx | grep more Actual results: No package available for ngx_headers_more Expected results: Installation of ngx_headers_more module by yum Additional info: https://github.com/openresty/headers-more-nginx-module#synopsis https://github.com/openresty/headers-more-nginx-module#installation http://serverfault.com/questions/755046/installing-nginx-headers-more-module-with-yum $ sudo yum install nginx-extras Loaded plugins: amazon-id, rhui-lb, search-disabled-repos No package nginx-extras available. Error: Nothing to do $ sudo yum -y install epel-release Loaded plugins: amazon-id, rhui-lb, search-disabled-repos Package epel-release-7-8.noarch already installed and latest version Nothing to do $ sudo yum search nginx | grep headers $
Hoping not to sound much biased about this (maintainer of GetPageSpeed repos here): Your options for up-to-date packaged ngx_headers_more (in lack of such in EPEL now) are such: * Commercial NGINX Plus subscription (hefty fees) * GetPageSpeed repository (a ten-dollar bill, continuously maintained and updated - both stable and mainline NGINX can be chosen, 30+ NGINX modules continuously rebuilt with every NGINX release and can be installed separately. Includes modules that are not available in NGINX Plus. So it's NGINX Plus+ :) * AFAIK, the author of ngx_headers_more has its own repository/NGINX builds (but named differently/installed separately from NGINX, so it *might* have SELinux adjustments required)
*** Bug 1518974 has been marked as a duplicate of this bug. ***
I have decided to not include 3rd party source code in the nginx package build process. I do, however, have enabled the --with-compat build flag in the nginx package, so it should be easy for people to build separate packages with the dynamic module.