One of the things which gives a potential attacker some help is them knowing which versions of software you use. This can be very easy to find out, particularly if you have never taken steps to secure this information.
For example: I would like to know what software apache.org are using/have used so I look at netcraft (for example) http://toolbar.netcraft.com/site_report?url=http://www.apache.org
192.87.106.226 Linux Apache/2.2.3 Unix mod_ssl/2.2.3 OpenSSL/0.9.7g 12-Apr-2007
I now know that I should look for exploits relating to linux, apache v2.2.3, mod_ssl 2.2.3 and OpenSSL0.9.7g.
By hiding this information you can either report simply “unknown” or just “apache” and no other info. This doesn’t directly make your box more secure, what it does do is start to make the task more difficult for a would-be attacker and for such a small amount of effort it really does seem silly not to do it. So how?
The first thing is to set the ServerTokens directive. I am using a RH linux box so if you know your OS differs, find the corresponding location of your httpd.conf:
vi or pico /etc/httpd/conf/httpd.conf
Find the line(s) containing ServerTokens and ServerSignature
ServerTokens has the following options (I used Prod):
ProductOnly Server: Apache
Major Server: Apache/2
Minor Server: Apache/2.2
Minimal Server: Apache/2.2.3
OS Server: Apache/2.2.3 (RedHat)
Full (or not specified) default Server: Apache/2.2.34 (RedHat) mod_ssl/2.2.3 OpenSSL/0.9.7g
The syntax is as follows:
ServerTokens ProductOnly
ServerSignature Off
Close the config file and restart apache (service apache restart OR /etc/init.d/httpd restart)
Recent Comments