1

We are using Springsource ERS Apache in our environment, regarding to hardening part Even after using ServerSignature Off, still we are receiving the

Server:Apache in the header information.

How can this be avoided?

Improve this question

2 Answers 2

Reset to default
2

You could install mod_security, a free add-on that will allow you to change the Server: header to what ever you wish, for example you could make it say "IIS" or just make it say "None of your business!" :)

Improve this answer
3
  • Could you ever tried mod_security installation with Springsource ERS Apache , becoz we are facing lot errors while doing "make" ]
    – Sivaguru Nathan
    Apr 18, 2011 at 13:47
  • No, I haven't. Instead of trying to compile it from source, why not see if there is a package available for your OS?
    – BenGC
    Apr 18, 2011 at 14:58
  • I think for Solaris , there wont be any package for solaris .. if its available means pls share ... the link where to download
    – Sivaguru Nathan
    Apr 18, 2011 at 15:21
0

The details as in the signature or headers are controlled by the ServerTokens directive. You cannot show less than "Apache" without modifying the source code and re-compiling Apache.

You shouldn't worry too much about this, there are other ways to get to know that you're using Apache: error pages (not just 404, but bad headers for example) or requesting .ht files (denied by default in Apache).

Improve this answer
1
  • Hi Lekensteyn, we are using customized error pages to avoid such vulnerability and disabled .ht access in our environment, came to know using mod_security we can completely disable this info , but the compilation of mod_security with Springsource has not been succeufully completed..
    – Sivaguru Nathan
    Apr 18, 2011 at 13:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .