Is it risky to post your apache site.conf files

Not that I can think of. I even have a tool to automate the creation of those files for anybody.

http://YOUR_DOMAIN_OR_SUBDOMAIN.c.jonsjava.com (centos/rhel/fedora) http://YOUR_DOMAIN_OR_SUBDOMAIN.u.jonsjava.com (ubuntu/debian)

unless yours is highly configured (and thereby falling outside the “typical” part you spoke of), there’s nothing damaging in those.

One caveat: if you have a poorly performing or badly-coded server-side script, they can use it to simplify directory traversal after finding an XSS entrypoint, but that’s after it’s been hacked, so it’s still trivial.

There’s very little sensitive information that could be exposed in an Apache site.conf. Some things like knowing that AllowOverride All is set on a directory could in theory provide an attacker something to probe, though following other best practices would thwart that. The attacker would already need write access to that directory to create an .htaccess file. Another theoretical piece of information that could be gleaned is whether SSL3 is enabled or not to take advantage of the “POODLE” vulnerability, though that is usally configured in /etc/apache2/mods-available/ssl.conf

If you follow general security best practices and apply security updates in a timely manner, sharing your Apache configuration won’t be a problem at all.