RE: [users@httpd] Apache/1.3.28 Server at foo.bar.edu Port 80 - the old ServerSignature debate...

[Boyle Owen <Ow...@swx.com>]

>-----Original Message-----
>From: Rafael Faura [mailto:rfaura@bassy.net]
>
>Yes, this is going to improve security, at least more than showing to
>everyone your apache version and compiled modules version 
>(a.k.a "hey, i'm
>using an Apache version that has a well-known bug") :P.

I love this recurring debate!

Consider this scenario:

Boss: So, Rafael, our server got hacked and all our customers have gone
away! How did this happen?

Rafael: I can't understand it boss... Sure, we were running an apache
version with a well-know bug, but I took every precaution - I hid the
ServerSignature. I don't know how they figured out we were vulnerable...

There are lots of novice users reading this list which is why your
erroneous opinion has to be challenged. It is important that new apache
admins learn good security habits and foremost among those is keeping
the OS and software up-to-date. If you do that, your ServerSignature is
as much use to a hacker as your IP address. If you convince new users
that obscuring the ServerSignature somehow improves security, they will
waste time on this fool's errand and, even worse, may delay or ignore
upgrades because they think they're safe. 

You can do what you like with your ServerSignature (that's why the
directive exists) but don't think it improves security. If you run a
vulnerable version, you can hide but you will get hacked. If you stay on
the crest of the version wave then you will be secure and it doesn't
matter who knows what version you're using. Obscuring the
ServerSignature is like covering up the word "Chubb" on a padlock and
thinking this makes it harder to pick.

Rgds,
Owen Boyle
Disclaimer: Any disclaimer attached to this message may be ignored. 


>
>
>Shashank, use these settings on your httpd.conf:
>
>ServerTokens Prod
>ServerSignature Off
>
>
>
>
>
>
>---------------------------------------------------------------------
>The official User-To-User support forum of the Apache HTTP 
>Server Project.
>See <URL:http://httpd.apache.org/userslist.html> for more info.
>To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>   "   from the digest: users-digest-unsubscribe@httpd.apache.org
>For additional commands, e-mail: users-help@httpd.apache.org
>
>

This message is for the named person's use only. It may contain
confidential, proprietary or legally privileged information. No
confidentiality or privilege is waived or lost by any mistransmission.
If you receive this message in error, please notify the sender urgently
and then immediately delete the message and any copies of it from your
system. Please also immediately destroy any hardcopies of the message.
You must not, directly or indirectly, use, disclose, distribute, print,
or copy any part of this message if you are not the intended recipient.
The sender's company reserves the right to monitor all e-mail
communications through their networks. Any views expressed in this
message are those of the individual sender, except where the message
states otherwise and the sender is authorised to state them to be the
views of the sender's company. 



---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

RE: [users@httpd] Apache/1.3.28 Server at foo.bar.edu Port 80 - the old ServerSignature debate...

[Rafael Faura <rf...@bassy.net>]

Well, i think that the original answer is asked and all of us know that
changing ServerSignature and ServerTokens doesn't *boost* your
security/protection in an Apache environment (i think that this statement
was obvious because in no place you will find a phrase that says: "if you
want to protect and secure your Apache server you only need to change
ServerSignature and ServerTokens; don't worry about upgrades, if a hacker
can't see which version you're running through error pages he can't hurt
you" ...). 

Anyway i'm glad of participate in such debates, anf of course in an educated
manner like this :)


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: [users@httpd] Apache/1.3.28 Server at foo.bar.edu Port 80 - the old ServerSignature debate...

[Brian Dessent <br...@dessent.net>]

Rafael Faura wrote:

> way to do it. Your scenario is a bit.. mmm, non-sense, none good admin will
> say that, lol.

Uhhh, what?  Your view is definitely in the minority of clueful
administrators if you ask me.  See also "security by obscurity."

> "If you run a vulnerable version you'll be hacked", ok, but you'll be hacked
> faster if you shows to everybody your version, right? (at least let that

If something's listening on port 80, it's eventually going to have a
test-exploit sent to it, regardless of what it's reporting to the
world.  And these days with backporting being common, the reported
version is of little use to the attacker anyway.  "This server says
2.0.40, is this an ancient unpatched version of Apache, or has this guy
been running his Redhat up2date?  I don't know, guess I'll just have to
test every server on port 80 I come upon."

> version, hehe >:)). Anyway, the first post of this series was related with a
> user that wants to hide it's apache version from server error pages... Of
> course he was asking only that, he didn't ask: "hey, i want to completely
> secure and protect my Apache server!!!", that's another story ;).

Yes, his request was very simple and easy to fill.  It was the unwritten
implication that this was under the guise of security that caused the
repliers to mention this fact, that it has no benefit.  That it went
challenged just goes to show that it's a common misconception and thus
the responses in this thread have served a useful purpose.

> Btw, changing TWO words on httpd.conf ('prod' and 'off' don't seem to me a
> enormous waste of time) and i don't think that somebody will ignore an
> important apache upgrade by the fact that they changed serversignature or
> servertokens ...

Sure it's easy to do.  So would be me taping a sign to my front door
that read "There is no TV in this house."  Do you think that would have
any affect on a burglar's likelyhood to leave, having come upon my house
in search of a TV to steal?  Especially if he noticed that indeed there
was a TV when he glanced in the window earlier...

Brian

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

RE: [users@httpd] Apache/1.3.28 Server at foo.bar.edu Port 80 - the old ServerSignature debate...

[Rafael Faura <rf...@bassy.net>]

There are lots of novice users reading this list which is why your
erroneous opinion has to be challenged. It is important that new apache
admins learn good security habits and foremost among those is keeping
the OS and software up-to-date. If you do that, your ServerSignature is
as much use to a hacker as your IP address. If you convince new users
that obscuring the ServerSignature somehow improves security, they will
waste time on this fool's errand and, even worse, may delay or ignore
upgrades because they think they're safe. 

You can do what you like with your ServerSignature (that's why the
directive exists) but don't think it improves security. If you run a
vulnerable version, you can hide but you will get hacked. If you stay on
the crest of the version wave then you will be secure and it doesn't
matter who knows what version you're using. Obscuring the
ServerSignature is like covering up the word "Chubb" on a padlock and
thinking this makes it harder to pick.

-----------------

Of course. I said that serversignature and servertokens are ONE of the ways
to improve security (maybe an insignificant improve) and not the ONLY one
way to do it. Your scenario is a bit.. mmm, non-sense, none good admin will
say that, lol.

"If you run a vulnerable version you'll be hacked", ok, but you'll be hacked
faster if you shows to everybody your version, right? (at least let that
hackers waste their time trying to figure which apache version are you using
and checking every apache bug/exploit from the first 1.x.xx & 2.x.xx
version, hehe >:)). Anyway, the first post of this series was related with a
user that wants to hide it's apache version from server error pages... Of
course he was asking only that, he didn't ask: "hey, i want to completely
secure and protect my Apache server!!!", that's another story ;).

Btw, changing TWO words on httpd.conf ('prod' and 'off' don't seem to me a
enormous waste of time) and i don't think that somebody will ignore an
important apache upgrade by the fact that they changed serversignature or
servertokens ... 



---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org