One of the things which gives a potential attacker some help is them knowing which versions of software you use. This can be very easy to find out, particularly if you have never taken steps to secure this information.
For example: I would like to know what software apache.org are using/have used so I look at netcraft (for example) http://toolbar.netcraft.com/site_report?url=http://www.apache.org
192.87.106.226 Linux Apache/2.2.3 Unix mod_ssl/2.2.3 OpenSSL/0.9.7g 12-Apr-2007
I now know that I should look for exploits relating to linux, apache v2.2.3, mod_ssl 2.2.3 and OpenSSL0.9.7g.
By hiding this information you can either report simply “unknown” or just “apache” and no other info. This doesn’t directly make your box more secure, what it does do is start to make the task more difficult for a would-be attacker and for such a small amount of effort it really does seem silly not to do it. So how?
The first thing is to set the ServerTokens directive. I am using a RH linux box so if you know your OS differs, find the corresponding location of your httpd.conf:
vi or pico /etc/httpd/conf/httpd.conf
Find the line(s) containing ServerTokens and ServerSignature
ServerTokens has the following options (I used Prod):
| ProductOnly | Server: Apache |
| Major | Server: Apache/2 |
| Minor | Server: Apache/2.2 |
| Minimal | Server: Apache/2.2.3 |
| OS | Server: Apache/2.2.3 (RedHat) |
| Full (or not specified) default | Server: Apache/2.2.34 (RedHat) mod_ssl/2.2.3 OpenSSL/0.9.7g |
The syntax is as follows:
ServerTokens ProductOnly
ServerSgnature Off
Close the config file and restart apache (service apache restart OR /etc/init.d/httpd restart)
It’s pretty easy to test this. Open a telnet program (start > run > telnet in windows or telnet in terminal)
Type (ignoring all quotes “”)
“open *your IP or domain* 80″
“HEAD / HTTP/1.0″
press enter twice
You should see Server: Apache (or other text depending how you have set it)
