You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Darragh Gammell <db...@gmail.com> on 2007/09/04 07:50:29 UTC
[users@httpd] HTTP reply. Too much systems information displayed.
Hi
Recently we had a a security audit, one of the issues stated was that our
servers report too much information which hackers can use.
see output from a netcraft site report.
OWNER IP OS WebServer
OWNER 123.123.123.123 Linux Apache
OWNER 123.123.123.123 Linux Apache/2.0.54 Ubuntu PHP/5.0.5-2ubuntu1
mod_ssl/2.0.54 OpenSSL/0.9.7g
OWNER 123.123.123.123 Linux Apache/1.3.34 Debian PHP/5.1.2
mod_gzip/1.3.26.1a mod_ssl/2.8.25 OpenSSL/0.9.8a mod_perl/1.29 DAV/1.0.3
OWNER 123.123.123.123 Linux Apache/1.3.33 Debian GNU/Linux PHP/5.0.4
mod_gzip/1.3.26.1a mod_ssl/2.8.22 OpenSSL/0.9.7d mod_perl/1.29 DAV/1.0.3
OWNER 123.123.123.123 Linux Apache/1.3.31 Debian GNU/Linux
mod_gzip/1.3.26.1a mod_ssl/2.8.19 OpenSSL/0.9.7d mod_perl/1.29 DAV/1.0.3
OWNER 123.123.123.123 Linux Apache/1.3.29 Debian GNU/Linux
mod_gzip/1.3.26.1a mod_ssl/2.8.16 OpenSSL/0.9.7c mod_perl/1.29 DAV/1.0.3
OWNER 123.123.123.123 Linux Apache/1.3.29 Debian GNU/Linux
mod_gzip/1.3.26.1a mod_ssl/2.8.16 OpenSSL/0.9.7c DAV/1.0.3
OWNER 123.123.123.123 Linux Apache/1.3.27 Debian GNU/Linux
mod_gzip/1.3.26.1a mod_ssl/2.8.14 OpenSSL/0.9.7b DAV/1.0.3
OWNER 123.123.123.123 Linux Apache/1.3.27 Unix Debian GNU/Linux
mod_gzip/1.3.26.1a mod_ssl/2.8.14 OpenSSL/0.9.7b DAV/1.0.3
OWNER 123.123.123.123 Linux Apache/1.3.27 Unix Debian GNU/Linux
mod_gzip/1.3.26.1a mod_ssl/2.8.14 OpenSSL/0.9.7a DAV/1.0.3
Does anyone know how to configure apache not to give this information out in
its http replies.
Thanks in advance
Darragh
Re: [users@httpd] HTTP reply. Too much systems information displayed.
Posted by Scott Wilcox <sc...@x0f.org>.
Hey Darragh,
Checkout http://httpd.apache.org/docs/1.3/mod/core.html#serversignature
for your 1.3 servers, and
http://httpd.apache.org/docs/2.0/mod/core.html#serversignature for your
2.0 server.
Also, then check out the ServerTokens directive too.
Hope this helps,
Scott.
Darragh Gammell wrote:
> Hi
>
> Recently we had a a security audit, one of the issues stated was that
> our servers report too much information which hackers can use.
>
> see output from a netcraft site report.
>
>
>
>
>
> OWNER IP OS WebServer
> OWNER 123.123.123.123 <http://123.123.123.123> Linux Apache
> OWNER 123.123.123.123 <http://123.123.123.123> Linux Apache/2.0.54
> Ubuntu PHP/5.0.5-2ubuntu1 mod_ssl/2.0.54 OpenSSL/0.9.7g
> OWNER 123.123.123.123 <http://123.123.123.123> Linux Apache/1.3.34
> Debian PHP/5.1.2 mod_gzip/1.3.26.1a mod_ssl/2.8.25 OpenSSL/0.9.8a
> mod_perl/1.29 DAV/1.0.3
> OWNER 123.123.123.123 <http://123.123.123.123> Linux Apache/1.3.33
> Debian GNU/Linux PHP/5.0.4 mod_gzip/1.3.26.1a mod_ssl/2.8.22
> OpenSSL/0.9.7d mod_perl/1.29 DAV/1.0.3
> OWNER 123.123.123.123 <http://123.123.123.123> Linux Apache/1.3.31
> Debian GNU/Linux mod_gzip/1.3.26.1a mod_ssl/2.8.19 OpenSSL/0.9.7d
> mod_perl/1.29 DAV/1.0.3
> OWNER 123.123.123.123 <http://123.123.123.123> Linux Apache/1.3.29
> Debian GNU/Linux mod_gzip/1.3.26.1a mod_ssl/2.8.16 OpenSSL/0.9.7c
> mod_perl/1.29 DAV/1.0.3
> OWNER 123.123.123.123 <http://123.123.123.123> Linux Apache/1.3.29
> Debian GNU/Linux mod_gzip/1.3.26.1a mod_ssl/2.8.16 OpenSSL/0.9.7c
> DAV/1.0.3
> OWNER 123.123.123.123 <http://123.123.123.123> Linux Apache/1.3.27
> Debian GNU/Linux mod_gzip/1.3.26.1a mod_ssl/2.8.14 OpenSSL/0.9.7b
> DAV/1.0.3
> OWNER 123.123.123.123 <http://123.123.123.123> Linux Apache/1.3.27
> Unix Debian GNU/Linux mod_gzip/1.3.26.1a mod_ssl/2.8.14 OpenSSL/0.9.7b
> DAV/1.0.3
> OWNER 123.123.123.123 <http://123.123.123.123> Linux Apache/1.3.27
> Unix Debian GNU/Linux mod_gzip/1.3.26.1a mod_ssl/2.8.14 OpenSSL/0.9.7a
> DAV/1.0.3
>
>
> Does anyone know how to configure apache not to give this information
> out in its http replies.
>
> Thanks in advance
>
> Darragh
>
Re: [users@httpd] HTTP reply. Too much systems information displayed.
Posted by Scott Wilcox <sc...@x0f.org>.
You're welcome :]
Darragh Gammell wrote:
> Hi Sander and Scott
>
> Thanks for that info, that works a treat
>
> cheers
>
> Darragh
>
>
> On 9/4/07, *Sander Temme* < sctemme@apache.org
> <ma...@apache.org>> wrote:
>
>
> On Sep 3, 2007, at 10:50 PM, Darragh Gammell wrote:
>
> > Does anyone know how to configure apache not to give this
> > information out in its http replies.
>
> Look at the ServerTokens directive:
>
> http://httpd.apache.org/docs/2.2/mod/core.html#servertokens
>
> If you need still more control, consider mod_security:
>
> http://www.modsecurity.org/
>
> S.
>
> --
> Sander Temme
> sctemme@apache.org <ma...@apache.org>
> PGP FP: 51B4 8727 466A 0BC3 69F4 B7B8 B2BE BC40 1529 24AF
>
>
>
>
>
Re: [users@httpd] HTTP reply. Too much systems information displayed.
Posted by Darragh Gammell <db...@gmail.com>.
Hi Sander and Scott
Thanks for that info, that works a treat
cheers
Darragh
On 9/4/07, Sander Temme <sc...@apache.org> wrote:
>
>
> On Sep 3, 2007, at 10:50 PM, Darragh Gammell wrote:
>
> > Does anyone know how to configure apache not to give this
> > information out in its http replies.
>
> Look at the ServerTokens directive:
>
> http://httpd.apache.org/docs/2.2/mod/core.html#servertokens
>
> If you need still more control, consider mod_security:
>
> http://www.modsecurity.org/
>
> S.
>
> --
> Sander Temme
> sctemme@apache.org
> PGP FP: 51B4 8727 466A 0BC3 69F4 B7B8 B2BE BC40 1529 24AF
>
>
>
>
>
Re: [users@httpd] HTTP reply. Too much systems information displayed.
Posted by Sander Temme <sc...@apache.org>.
On Sep 3, 2007, at 10:50 PM, Darragh Gammell wrote:
> Does anyone know how to configure apache not to give this
> information out in its http replies.
Look at the ServerTokens directive:
http://httpd.apache.org/docs/2.2/mod/core.html#servertokens
If you need still more control, consider mod_security:
http://www.modsecurity.org/
S.
--
Sander Temme
sctemme@apache.org
PGP FP: 51B4 8727 466A 0BC3 69F4 B7B8 B2BE BC40 1529 24AF