I don't want anyone to be able to detect that I'm using NGINX or even Ubuntu from the internet. There are tools out there (such as BuiltWith) which scan servers to detect what tools they're using. Also, some cracking tools might help with deteting. What's the best / closest to that I can get to hiding all this info from the outside?
You can stop it outputting the version of Nginx and OS by adding
Or if you want to remove the Server header completely, you need to compile Nginx with the Headers More module in, as the header is hard coded in the Nginx source, and this module allows changing any http headers.
However, there are many hidden ways servers perform by accident via their implementation which may help identify the system. e.g. How it responds to a bad SSL request. I don't see a practical way of preventing this.
Some of the things I might suggest:
@Martin F. Yes it does. You will have to compile it from source and change what's needed before compiling the source.
I asume you donwloaded the last stable version you decompressed it and you know where the files are. If that's the case, do the following:
Then look for line 48 if I recall correctly.
Replace nginx with MyWhateverServerNameIWant e.g.
look for the line
change "nginx/" to "MyWhateverServerNameIWant/" so it will read
Finally if you want also change the version number
look for the line #define NGINX_VERSION "1.0.4"
and change "1.0.4" for whatever version you want. For example it will read
Hope it helps. Nevertheless. Securing a server goes far beyond not showing what's running. PHP is by nature insecure, and so is linux. Off course linux can be pretty secure if all needed measures are taken in order to achieve a decent security. As far as PHP is concerned I would recommend using Suoshin to help harden the security of your code.
After a lot of time working out how to do a custom flavor of nginx on ubuntu I realized you can use the lua module for this.
On ubuntu 14.04 if you install the
Throw this in the http block and every request will be lacking a
If it doesn't work run
If you have installed nginx using apt-get in Debian or Ubuntu, you might need to install the package nginx-extras to set or clear "Server" header
Once this is done, you can add the lines below in nginx.conf (usually /etc/nginx/nginx.conf):
To clear the "Server" header altogether:
To Set a custom string as "Server"