{"id":1090,"date":"2013-02-19T18:00:58","date_gmt":"2013-02-20T02:00:58","guid":{"rendered":"http:\/\/www.virendrachandak.com\/techtalk\/\/?p=1090"},"modified":"2014-10-09T11:01:19","modified_gmt":"2014-10-09T18:01:19","slug":"how-to-hide-apache-information-with-servertokens-and-serversignature-directives","status":"publish","type":"post","link":"https:\/\/www.virendrachandak.com\/techtalk\/how-to-hide-apache-information-with-servertokens-and-serversignature-directives\/","title":{"rendered":"How to hide apache information with ServerTokens and ServerSignature directives"},"content":{"rendered":"

In default Apache configuration, the server sends HTTP Header with the information of Apache version, modules, Operating System, etc of the Server. The HTTP response header \u201cServer\u201d displays all these details of the server. This information can be used by hackers to try to exploit any vulnerabilities in the Apache, OS or other modules you are running, specially if you are running an older version with known vulnerabilities.<\/p>\n

Sample HTTP Response Header:<\/p>\n

\r\nHTTP\/1.1 200 OK\r\nDate: Sun, 10 Feb 2012 07:24:47 GMT\r\nServer: Apache\/2.2.17 (Win32) PHP\/5.2.17\r\nVary: Accept-Encoding,Cookie\r\n<\/pre>\n
<\/p>\n
Note<\/strong>: This is just one way to identify the details. Also, even if this information is not available hackers might still try to hack it using other ways.<\/div>\n
There is an easy way to hide the apache version and other server information from the HTTP headers. By setting the “ServerTokens<\/strong>” and “ServerSignature<\/strong>” variables in your httpd.conf file the server information would not longer be added to the HTTP headers. Use the following lines in you httpd.conf file. Make sure to back up you file before editing so that in case something goes wrong you can easily revert. After making the changes restart your apache (Note<\/strong>: Doing so will take your site down, if it runs only on 1 server).<\/p>\n
\r\nServerTokens ProductOnly\r\nServerSignature Off\r\n<\/pre>\n
After using the above directives the HTTP headers will look similar to this:<\/div>\n
\r\nHTTP\/1.1 200 OK\r\nDate: Sun, 10 Feb 2012 07:24:47 GMT\r\nServer: Apache\r\nVary: Accept-Encoding,Cookie\r\n<\/pre>\n
\nThe ServerTokens Directive controls the response which server sends to include the server details, OS and other complied modules. ServerTokens can have various values. Here are the outputs of each different values<\/p>\n\n\n\n\n\n\n\n\n\n
ServerTokens Value<\/th>\nServer Sends<\/th>\n<\/tr>\n
Full (or not specificed)<\/td>\nServer: Apache\/2.2.17 (Win32) PHP\/5.2.17<\/td>\n<\/tr>\n
Prod (or ProductOnly)<\/td>\nServer: Apache<\/td>\n<\/tr>\n
Major<\/td>\nServer: Apache\/2<\/td>\n<\/tr>\n
Minor<\/td>\nServer: Apache\/2.2<\/td>\n<\/tr>\n
Min (or Minimal)<\/td>\nServer: Apache\/2.2.17<\/td>\n<\/tr>\n
OS<\/td>\nServer: Apache\/2.2.17 (Win32)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n
\nThe ServerSignature Directive can be used to configure a trailing footer line under the server-generated documents (e.g. error pages, directory listing etc). The default setting for this directive is Off, which does not displays the footer line. If this is set to On, the server will add a line with the server version number and ServerName of the virutal host. If we set this value to Email, it will add a “mailto:” link to the ServerAdmin defined in the server configuration. After Apache 2.0.44 the value of Server version number is controlled by the ServerTokens Directive.\n<\/div>\n
\nNote<\/strong><\/span>: Make these changes in your server only if you are sure you know you can do them. If you make a mistake in the httpd.conf file, your site won’t work. So be very careful when making these changes. Also, it is always good to take a backup of the existing file before making any changes, in case you want to revert.\n<\/div>\n
\nRelated Links<\/strong>:<\/p>\n