Bug 1408484 - sudo yum install ngx_headers_more fails
Summary: sudo yum install ngx_headers_more fails
Alias: None
Product: Fedora EPEL
Classification: Fedora
Component: nginx
Version: epel7
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
Assignee: Felix Kaechele
QA Contact: Fedora Extras Quality Assurance
: 1518974 (view as bug list)
Depends On:
TreeView+ depends on / blocked
Reported: 2016-12-23 17:18 UTC by Geoffrey Hoffman
Modified: 2021-04-21 14:27 UTC (History)
11 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2021-04-21 14:27:28 UTC
Type: Bug

Attachments (Terms of Use)

Description Geoffrey Hoffman 2016-12-23 17:18:18 UTC
Description of problem:

A routine security audit revealed the presence of "Server: nginx" in the HTTP response headers when serving content from RedHat/CentOS using the popular web browser, Nginx. 

For security reasons, it is recommended, if not required, to change or remove this header. 

ngx_headers_more module provides this feature, however, installation currently requires compiling nginx from source, though a dynamic module load option is available.

It is requested to add the ngx_headers_more module to yum installation in EPEL repository. Debian-based systems feature this module via 

apt-get install nginx-extras

Version-Release number of selected component (if applicable):

Nginx version 1.10.x

How reproducible:

Steps to Reproduce:
1.yum search nginx | grep more

Actual results:
No package available for ngx_headers_more

Expected results:
Installation of ngx_headers_more module by yum

Additional info:


$ sudo yum install nginx-extras
Loaded plugins: amazon-id, rhui-lb, search-disabled-repos
No package nginx-extras available.
Error: Nothing to do
$ sudo yum -y install epel-release
Loaded plugins: amazon-id, rhui-lb, search-disabled-repos
Package epel-release-7-8.noarch already installed and latest version
Nothing to do
$ sudo yum search nginx | grep headers

Comment 1 Danila Vershinin 2019-11-20 21:56:04 UTC
Hoping not to sound much biased about this (maintainer of GetPageSpeed repos here):

Your options for up-to-date packaged ngx_headers_more (in lack of such in EPEL now) are such:

* Commercial NGINX Plus subscription (hefty fees)
* GetPageSpeed repository (a ten-dollar bill, continuously maintained and updated - both stable and mainline NGINX can be chosen, 30+ NGINX modules continuously rebuilt with every NGINX release and can be installed separately. Includes modules that are not available in NGINX Plus. So it's NGINX Plus+ :)
* AFAIK, the author of ngx_headers_more has its own repository/NGINX builds (but named differently/installed separately from NGINX, so it *might* have SELinux adjustments required)

Comment 2 Felix Kaechele 2020-05-17 03:04:43 UTC
*** Bug 1518974 has been marked as a duplicate of this bug. ***

Comment 3 Felix Kaechele 2021-04-21 14:27:28 UTC
I have decided to not include 3rd party source code in the nginx package build process.
I do, however, have enabled the --with-compat build flag in the nginx package, so it should be easy for people to build separate packages with the dynamic module.

Note You need to log in before you can comment on or make changes to this bug.