up vote 3 down vote favorite
1
share [g+] share [fb]

I have a Rails application served using Apache 2 and Phusion Passenger. As a security measure I'm trying to supress all server-related HTTP headers. I've successfully turned off the Apache ones, but I'm having trouble using mod_headers to supress the Passenger ones. I've enabled mod_headers using the a2enmod command and restarted the Apache process, but the X-Powered-By and X-Runtime headers still appear.

This is my vhost file:

<VirtualHost *:80>

  ServerAdmin webmaster@example.com
  ServerName  example.com
  ServerAlias www.example.com

  DocumentRoot /home/deploy/public_html/railsapp/current/public

  LogLevel warn
  ErrorLog /home/deploy/public_html/railsapp/shared/log/error.log
  CustomLog /home/deploy/public_html/railsapp/shared/log/access.log combined

  # Suppress Phusion Passenger HTTP headers
  <Location *>
    <IfModule mod_headers.c>
      Header unset X-Runtime
      Header unset X-Powered-By
    </IfModule>
  </Location>
</VirtualHost>
  • What am I doing wrong?
link|improve this question
100% accept rate
feedback

3 Answers

up vote 1 down vote accepted

From the mod_headers docs:

The directives provided by mod_headers can occur almost anywhere within the server configuration. They are valid in the main server config and virtual host sections, inside , and sections, and within .htaccess files.

If you want this to apply to the whole vhost, why put it inside <Location> tags? Just put the directives inside the main vhost config.

<VirtualHost *:80>

  ServerAdmin webmaster@example.com
  ServerName  example.com
  ServerAlias www.example.com

  DocumentRoot /home/deploy/public_html/railsapp/current/public

  LogLevel warn
  ErrorLog /home/deploy/public_html/railsapp/shared/log/error.log
  CustomLog /home/deploy/public_html/railsapp/shared/log/access.log combined

  <IfModule mod_headers.c>
    Header unset X-Runtime
    Header unset X-Powered-By
  </IfModule>

</VirtualHost>

I haven't tested this so apologies in advance if it's incorrect.

link|improve this answer
1  
Thanks Andrew. I think I misread the docs regarding the <Location> elements. I had to use "Header always unset..." to get it to work. – John Topley Aug 2 '09 at 14:20
Vote me up dude! :) – Andrew H Aug 3 '09 at 8:17
Voted up in lieu of the OP – Andrew Feb 17 '10 at 2:17
feedback
up vote 1 down vote

I don't have an Apache install to hand but <Location *> looks suspect. The docs say:

The URL may use wildcards. In a wild-card string, ? matches any single character, and * matches any sequences of characters. Neither wildcard character matches a / in the URL-path.

I suspect you're not matching any URLs. Try:

<Location />
  <IfModule mod_headers.c>
    Header unset X-Runtime
    Header unset X-Powered-By
  </IfModule>
</Location>
link|improve this answer
Thanks Mark. I tried this, but unfortunately it doesn't work. – John Topley Aug 2 '09 at 9:11
Hm! Tried running in debug mode? httpd -X -c "LogLevel debug" might throw something up. You could also try removing the IfModule in case the module is silently failing to load for some reason. Also, see this: groups.google.com/group/phusion-passenger/browse_thread/thread/… – markdrayton Aug 2 '09 at 12:52
feedback
up vote 1 down vote

Leaving aside that it's still really easy to determine the server, at least to corse versions even eithout headers, and the "script kiddies" just try all attacks and don't bother to check versions anyway.

What happens if you remove the line, just leave the commands.

I'd wonder if it's even being loaded, try adding a static header to verify.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.