Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I don't want anyone to be able to detect that I'm using NGINX or even Ubuntu from the internet. There are tools out there (such as BuiltWith) which scan servers to detect what tools they're using. Also, some cracking tools might help with deteting. What's the best / closest to that I can get to hiding all this info from the outside?

share|improve this question
add comment

2 Answers

up vote 8 down vote accepted

You can stop it outputting the version of Nginx by adding

server_tokens off;

Or if you want to remove the Server header completely, you need to compile Nginx with the Headers More module in, as the header is hard coded in the Nginx source, and this module allows changing any http headers.

 more_clear_headers Server;

However, there are many hidden ways servers perform by accident via their implementation which may help identify the system. e.g. How it responds to a bad SSL request. I don't see a practical way of preventing this.

Some of the things I might suggest:

  • change error templates
  • block all ports except the services needed
share|improve this answer
4  
Agreed. Look at nmap's OS detection for instance - this looks at the target hosts's responses to IP/TCP requests and is able to determine the OS that way. It's really not worth putting effort into this. –  EEAA Dec 19 '10 at 21:52
3  
+1 on ErikA's advice. Better to secure your server as best as you can rather than relying on security through obscurity. –  Andy Smith Dec 19 '10 at 21:54
    
@ErikA, @Andy, @Andy Smith - thanks guys. –  orokusaki Dec 20 '10 at 0:59
1  
Server tokens only turn off the version number. Nginx does not allow for completely removing the header. –  Martin Fjordvald Dec 20 '10 at 18:46
add comment

@Martin F. Yes it does. You will have to compile it from source and change what's needed before compiling the source.

I asume you donwloaded the last stable version you decompressed it and you know where the files are. If that's the case, do the following:

nano src/http/ngx_http_header_filter_module.c

Then look for line 48 if I recall correctly.

static char ngx_http_server_string[] = "Server: nginx" CRLF;

Replace nginx with MyWhateverServerNameIWant e.g.

static char ngx_http_server_string[] = "Server: MyWhateverServerNameIWant" CRLF; 

Then

nano src/core/nginx.h 

look for the line

#define NGINX_VER          "nginx/" NGINX_VERSION

change "nginx/" to "MyWhateverServerNameIWant/" so it will read

#define NGINX_VER          "MyWhateverServerNameIWant" NGINX_VERSION

Finally if you want also change the version number

look for the line #define NGINX_VERSION "1.0.4"

and change "1.0.4" for whatever version you want. For example it will read

#define NGINX_VERSION      "5.5.5"

Hope it helps. Nevertheless. Securing a server goes far beyond not showing what's running. PHP is by nature insecure, and so is linux. Off course linux can be pretty secure if all needed measures are taken in order to achieve a decent security. As far as PHP is concerned I would recommend using Suoshin to help harden the security of your code.

share|improve this answer
    
+1, thanks. I'm leaving @Andy's as the official, just due to the easier approach, but this is excellent information. –  orokusaki Jun 12 '11 at 2:47
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.