Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I would like to remove the line:

Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch mod_ssl/2.2.8 OpenSSL/0.9.8g

from my server's HTTP responses, but I couldn't find anything other than to modify include/ap_release.h and compile Apache myself. I was wondering if there is a way I don't know about?

share|improve this question

2 Answers 2

up vote 11 down vote accepted

You can remove or mask the server identification from the Http-Header by using the ModSecurity open source web application firewall.

Server identity masking

One technique that often helps slow down and confuse attackers is the web server identity change. Web servers typically send their identity with every HTTP response in the Server header. Apache is particularly helpful here, not only sending its name and full version by default, but it also allows server modules to append their versions too.

To change the identity of the Apache web server you would have to go into the source code, find where the name "Apache" is hard-coded, change it, and recompile the server. The same effect can be achieved using the

SecServerSignature directive:

SecServerSignature "Microsoft-IIS/5.0"

It should be noted that although this works quite well, skilled attackers (and tools) may use other techniques to "fingerprint" the web server. For example, default files, error message, ordering of the outgoing headers, the way the server responds to certain requests and similar - can all give away the true identity. I will look into further enhancing the support for identity masking in the future releases of mod_security.

If you change Apache signature but you are annoyed by the strange message in the error log (some modules are still visible - this only affects the error log, from the outside it still works as expected):

[Fri Jun 11 04:02:28 2004] [notice] Microsoft-IIS/5.0 mod_ssl/2.8.12 OpenSSL/0.9.6b \ configured -- resuming normal operations

Then you should re-arrange the modules loading order to allow mod_security to run last, exactly as explained for chrooting.

Note

In order for this directive to work you must leave/set ServerTokens to Full.

When the SecServerSignature directive is used to change the public server signature, ModSecurity will start writing the real signature to the error log, to allow you to identify the web server and the modules used.

Source: ModSecurity Reference Manual

share|improve this answer
    
Ah, NICE! But the source link at the bottom is not working? Blank page? –  Erwinus May 23 at 23:48
    
It is running right now but I think it is not smart to use another existing servername because you can trigger attack actions. –  Erwinus May 24 at 0:56

If you set ServerTokens to "Prod", you can reduce the header to "Server: Apache". (See documentation for full list of options.)

If you want to remove the word "Apache" entirely, you'll have to modify the source.

share|improve this answer
    
+1 tnx for the reply, I forgot to mention in question I was aware of this but I want to have it say Microsoft IIS or something. I should have made that clear. –  Neo May 22 '11 at 19:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.