Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running Mod_Security and I'm using the SecServerSignature to customize the Server header that Apache returns. This part works fine, however I'm also running mod_fcgid which appends "mod_fcgid/2.3.5" to the header.

Is there any way I can turn this off? Setting ServerSignature off doesn't do anything. I was able to get it to go away by changing the ServerTokens but that removed the customization I had added.

share|improve this question
add comment

2 Answers 2

ServerTokens is what manipulates the Server response header. (ServerSignature is used for server generated documents.)

However, if you want to completely control the Server header I would suggest using the Header option:

Header set Server "Apache/2 my_customizations"

as an example.

share|improve this answer
    
hmmm... That doesn't seem to work. I don't think Apache allows you to override the server header that way. –  matthew Nov 2 '10 at 17:32
add comment

You may need to reorder the module loading in Apache so mod_security loads after mod_fcgi.

Read the "Server identity masking" section of the mod_security docs.
http://www.modsecurity.org/documentation/modsecurity-apache/1.9.3/html-multipage/06-special_features.html

Two notes: Mod_security will show the real server signature in the error_log which will be different than the one given to the public.

Second, the document also explains that SecServerSignature directive only works with ServerTokens set to "Full"

Mark

share|improve this answer
    
I've tried loading the module first and last, and it doesn't make a difference. I also doubled checked and ServerTokens are set to "Full" and the problem is in the actual response header not just the logs. Thanks –  matthew Nov 17 '10 at 16:59
    
I'm not a great coder, but I did not see anything in the most recent version of mod_fcgi that would place an entry in the server description. What version are you running? –  mfarver Nov 18 '10 at 18:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.