You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Milind Sawant <mi...@skandiabank.ch> on 2002/01/29 18:17:53 UTC
hding apache version in the http header
Hi All
I am using apache http server version 1.3.19.
This version is sent as a http header between the browser and apache.
Server: Apache/1.3.19 (Unix) mod_ssl/2.8.3 OpenSSL/0.9.5a
Is it possible to do any configuration on apache to hide the version for
security reasons?
If not , is there any other way to achieve this?
waiting for any reply
thanks
Milind
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: hding apache version in the http header
Posted by Owen Boyle <ob...@bourse.ch>.
Milind Sawant wrote:
> This version is sent as a http header between the browser and apache.
> Server: Apache/1.3.19 (Unix) mod_ssl/2.8.3 OpenSSL/0.9.5a
>
> Is it possible to do any configuration on apache to hide the version..
Use the ServerTokens directive, e.g.
ServerTokens ProductOnly
Although bear in mind that you make life difficult for agencies doing
web-surveys...
> for security reasons?
Aha! That's another matter... You are obviously under the impression
that if a hacker knows what version of apache you have, he will find it
easier to break in. I would argue that this is not true - a hacker will
try his exploits no matter what version you say you have and if your
system is insecure, he will break in. Security comes through ensuring
you have a well-configured FW and server, with attention paid to all
known holes - not through trying to hide your version.
To put it another way, it's like scraping the word "Chubb" or "Yale" off
your door-lock in the hope that a burglar will be so baffled by this
that he will not attempt to break in :-)
rgds,
Owen Boyle.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: avoiding display of apache version when authentication cancelled
Posted by Rodent of Unusual Size <Ke...@Golux.Com>.
Milind Sawant wrote:
>
> I have given "ServerTokens ProductOnly" in the apache
> configuration so that the apache version is not sent
> in the http header.
Right.
> I have configured basic authentication on apache for some
> resource. on the popup for authentication , if "Cancel" is
> clicked , the following is thrown on the browser
That's controlled by a different directive; see
<URL:http://httpd.apache.org/docs/mod/core.html#serversignature>.
--
#ken P-)}
Ken Coar, Sanagendamgagwedweinini http://Golux.Com/coar/
Author, developer, opinionist http://Apache-Server.Com/
"Millennium hand and shrimp!"
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
avoiding display of apache version when authentication cancelled
Posted by Milind Sawant <mi...@skandiabank.ch>.
Hi
I have given "ServerTokens ProductOnly" in the apache configuration so that
the apache version is not sent
in the http header.
The problem
I have configured basic authentication on apache for some resource.
on the popup for authentication , if "Cancel" is clicked , the following is
thrown on the browser
Authorization Required
This server could not verify that you are authorized to access the document
requested. Either you supplied the wrong credentials (e.g., bad password),
or your browser doesn't understand how to supply the credentials required.
----------------------------------------------------------------------------
----
Apache/1.3.19 Server at host Port port
as you can see the apache version is displayed .
Is there a way to avoid this or to throw a customized error message?
thanks for your support
Milind
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org