Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm running Mod_Security and I'm using the SecServerSignature to customize the Server header that Apache returns. This part works fine, however I'm also running mod_fcgid which appends "mod_fcgid/2.3.5" to the header.

Is there any way I can turn this off? Setting ServerSignature off doesn't do anything. I was able to get it to go away by changing the ServerTokens but that removed the customization I had added.

share|improve this question

3 Answers 3

ServerTokens is what manipulates the Server response header. (ServerSignature is used for server generated documents.)

However, if you want to completely control the Server header I would suggest using the Header option:

Header set Server "Apache/2 my_customizations"

as an example.

share|improve this answer
    
hmmm... That doesn't seem to work. I don't think Apache allows you to override the server header that way. –  matthew Nov 2 '10 at 17:32

You may need to reorder the module loading in Apache so mod_security loads after mod_fcgi.

Read the "Server identity masking" section of the mod_security docs.
http://www.modsecurity.org/documentation/modsecurity-apache/1.9.3/html-multipage/06-special_features.html

Two notes: Mod_security will show the real server signature in the error_log which will be different than the one given to the public.

Second, the document also explains that SecServerSignature directive only works with ServerTokens set to "Full"

Mark

share|improve this answer
    
I've tried loading the module first and last, and it doesn't make a difference. I also doubled checked and ServerTokens are set to "Full" and the problem is in the actual response header not just the logs. Thanks –  matthew Nov 17 '10 at 16:59
    
I'm not a great coder, but I did not see anything in the most recent version of mod_fcgi that would place an entry in the server description. What version are you running? –  mfarver Nov 18 '10 at 18:23

Use ServerTokens in a config file.

ServerTokens

This directive configures what you return as the Server HTTP response Header. The default is 'Full' which sends information about the OS-Type and compiled in modules.

Set to one of: Full | OS | Minor | Minimal | Major | Prod where Full conveys the most information, and Prod the least.

I suggest to set it to Prod, then they will only see that you are using Apache Server at domain.com Port 80.

Don't forget to restart/reload the Apache config files!

https://httpd.apache.org/docs/2.2/mod/core.html#servertokens

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.