ServerTokens Prod, ServerSignature Off
I tend to forget the syntax every time, but one of the first things I do when I setup an Apache web server is add/edit these two directive in my httpd.conf:
ServerSignature Off ServerTokens Prod
The first one,
ServerSignature Off tells apache not to display the server version on error pages, or other pages it generates.
The second one
ServerTokens Prod tells apache to only return Apache in the Server header, returned on every page request.
Why do this?
I do this for security reasons. Its not a good idea to broadcast the versions of software your running. While it doesn't make your server any more secure, it may make you less of a target.
What if I am running IIS?
On IIS the
Server header does not give as much version detail as Apache, but it can let someone know what primary OS version you are running (eg Windows 2008, 2012, 2012 r2).
For IIS you can use Microsoft's Free URLScan tool, that latest version of this tool now supports IIS 7.
Another option for IIS 7-8.5 is the StripHeaders IIS module.
What if my server header says Apache-Coyote/1.1?
This means that the header is coming from Tomcat, you can edit the value of the server header by editing
server.xml and adding or editing the
server attribute of the
- HTTP Request Smuggling (HRS) - June 10, 2005
- Apache Security Patches on CentOS / RHEL - November 22, 2013
- Blocking .svn and .git Directories on Apache or IIS - October 15, 2013
- Changing the ColdFusion CFIDE Scripts Location - January 10, 2011
- HTTP Strict Transport Security - September 17, 2010
- Apache Webserver: Signatur unterdrücken Undertec Blog
Apache Web Server version 2.2.16 was detected on the host.
Have to think of something else :(
and Apache 2+
works fine thx!
I was not able to find this info in the net. Hope it helps someone
This is achievable via URLRewrite outbound rule as well for IIS 7.
That said, it only affects the Server header, one of two that HackmyCF will detect on a typical IIS-based installation of CF. The other it sees (and will require you to resolve) is the X-Powered-By: ASP.NET header, and Pete shows how to clear that in another technote here, http://www.petefreitag.com/item/722.cfm.
You'll want to use it to create a new outbound rule with the following configuration:
Matching scope: Server Variable
Variable name: RESPONSE_Server
Variable value: Matches the Pattern
Using: Regular Expressions
Action type: Rewrite
Value: Whatever you want your server header to be.
Hope that helps.
- Java 9 Security Enhancements
- Upcoming CFML Conferences in April 2017
- CFSummit 2016 Slides
- Securing Legacy CFML - dev.Objective() 2016 Slides
- My CFSummit 2015 Slide Decks
- Adding Chrome Custom Search for CFDocs
- Disable Flash Remoting on ColdFusion Servers
- HackMyCF Adds SSL/TLS Scanner