Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Rails application served using Apache 2 and Phusion Passenger. As a security measure I'm trying to supress all server-related HTTP headers. I've successfully turned off the Apache ones, but I'm having trouble using mod_headers to supress the Passenger ones. I've enabled mod_headers using the a2enmod command and restarted the Apache process, but the X-Powered-By and X-Runtime headers still appear.

This is my vhost file:

<VirtualHost *:80>

  ServerAdmin webmaster@example.com
  ServerName  example.com
  ServerAlias www.example.com

  DocumentRoot /home/deploy/public_html/railsapp/current/public

  LogLevel warn
  ErrorLog /home/deploy/public_html/railsapp/shared/log/error.log
  CustomLog /home/deploy/public_html/railsapp/shared/log/access.log combined

  # Suppress Phusion Passenger HTTP headers
  <Location *>
    <IfModule mod_headers.c>
      Header unset X-Runtime
      Header unset X-Powered-By
    </IfModule>
  </Location>
</VirtualHost>
  • What am I doing wrong?
share|improve this question

3 Answers 3

up vote 4 down vote accepted

From the mod_headers docs:

The directives provided by mod_headers can occur almost anywhere within the server configuration. They are valid in the main server config and virtual host sections, inside , and sections, and within .htaccess files.

If you want this to apply to the whole vhost, why put it inside <Location> tags? Just put the directives inside the main vhost config.

<VirtualHost *:80>

  ServerAdmin webmaster@example.com
  ServerName  example.com
  ServerAlias www.example.com

  DocumentRoot /home/deploy/public_html/railsapp/current/public

  LogLevel warn
  ErrorLog /home/deploy/public_html/railsapp/shared/log/error.log
  CustomLog /home/deploy/public_html/railsapp/shared/log/access.log combined

  <IfModule mod_headers.c>
    Header unset X-Runtime
    Header unset X-Powered-By
  </IfModule>

</VirtualHost>

I haven't tested this so apologies in advance if it's incorrect.

share|improve this answer
1  
Thanks Andrew. I think I misread the docs regarding the <Location> elements. I had to use "Header always unset..." to get it to work. –  John Topley Aug 2 '09 at 14:20

I don't have an Apache install to hand but <Location *> looks suspect. The docs say:

The URL may use wildcards. In a wild-card string, ? matches any single character, and * matches any sequences of characters. Neither wildcard character matches a / in the URL-path.

I suspect you're not matching any URLs. Try:

<Location />
  <IfModule mod_headers.c>
    Header unset X-Runtime
    Header unset X-Powered-By
  </IfModule>
</Location>
share|improve this answer
    
Thanks Mark. I tried this, but unfortunately it doesn't work. –  John Topley Aug 2 '09 at 9:11
    
Hm! Tried running in debug mode? httpd -X -c "LogLevel debug" might throw something up. You could also try removing the IfModule in case the module is silently failing to load for some reason. Also, see this: groups.google.com/group/phusion-passenger/browse_thread/thread/… –  markdrayton Aug 2 '09 at 12:52

Leaving aside that it's still really easy to determine the server, at least to corse versions even eithout headers, and the "script kiddies" just try all attacks and don't bother to check versions anyway.

What happens if you remove the line, just leave the commands.

I'd wonder if it's even being loaded, try adding a static header to verify.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.