Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can I make it appear as though I'm not running Apache? I figure the best way is to appear as though it is another type of httpd, like lighthttpd or iis. I know that by using mod_security you can change your server signature into anything:

SecServerSignature "Microsoft IIS"

Does anyone know of other tricks in obscuring the HTTPD being used?

share|improve this question
add comment

4 Answers 4

up vote 7 down vote accepted

Why would you attempt this?

There are so many obvious and non-obvious ways that apache httpd reveals itself. Spend your time on real security instead. Version identifiers, stock pages, HTTP headers and loaded modules are just some of the ways Apache httpd reveals itself.

Run apache with a few modules loaded as possible. Ship logs off to another host and do real-time log analysis.

Design your system so that a compromise of apache doesn't lead to direct access to whatever you're trying to protect.

share|improve this answer
2  
Also, most automated attacks don't check server fingerprint at all, as evidenced by the many iis+asp based attack attempts I see in my Apache logs (and vice-versa). Hiding what your server runs makes no difference if the bot doesn't care an tries anyway. –  David Spillett Jan 24 '10 at 1:06
    
+1 for WHY spend time on this psudeo-security. –  Josh Brower Jan 24 '10 at 16:54
    
Who said I was defending against automated attacks? Giving any information to an attacker is a serious problem. I am a penetration tester and an exploit writer. –  Rook Jan 28 '10 at 18:16
add comment

There are 2 ways. The simplest is to add this to your apache config file :

ServerSignature Off
ServerTokens Prod

The other one is to change this file /src/include/httpd.h in the apache source. Change :

#define SERVER_BASEVENDOR “Apache Group”
#define SERVER_BASEPRODUCT “Apache”
#define SERVER_BASEREVISION “”

to

define SERVER_BASEVENDOR: Microsoft
define SERVER_BASEPRODUCT: Microsoft-IIS
define SERVER_BASEREVISION: 5.0

Then recomplie apache.

Others solutions may exits, try "Apache banner faking" on google.

share|improve this answer
add comment

One can tell that Apache is being run from the style and content of the stock error pages (404, 500, etc.). Specify your own.

share|improve this answer
add comment

As Holst stated, you should really question why you you are wanting to obscure your host. Obscurity is one mechanism for security, but should be assumed to be the weakest, and as such needs to be only one layer in a much more robust security architecture.

I would highly recommend reviewing the CIS Benchmark for Apache and implementing whatever can be used in your environment. Along with NIST, the Center for Internet Security benchmarks are often used as the basis for standard configurations. Which is great, since the Professional Feed from Nessus includes audit files for comparing against the CIS benchmarks. Moreover, this puts you on the road towards a standard configuration that can be easily audited and greatly lowers the risks associated with attempting to adequately manage a multitude of dissimilar systems.

Going back to the original question, the CIS Apache Benchmark v2.2 recommend the following settings for Information Leakage Protection

ServerTokens Prod
ServerSignature Off 
share|improve this answer
    
+1 for pointing to CIS Benchmark –  Josh Brower Jan 24 '10 at 16:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.