16

My server responds with Server: Apache/2.2.15 (CentOS) to all requests. I guess that this gives away my server architecture making it easier to hack attempts.

Is this ever useful to a web browser? Should I keep it on?

1
  • Obviously I'm keeping my servers updated with yum-cron also! Mar 6, 2014 at 16:40

3 Answers 3

16

In my opinion, it is best to mask this as much as possible. It's one of the tool you use to hack a web site - discover its technology, use the known flaws of that technology. The same reason why security best practice a while back started promoting to have urls in the form "/view/page" instead of "/view/page.jsp" or "/view/page.asp"... so the underlying technology would not be exposed.

There are some discussions about this such as https://stackoverflow.com/questions/843917/why-does-the-server-http-header-exist and http://www.troyhunt.com/2012/02/shhh-dont-let-your-response-headers.html and obviously Hacking Exposed book.

Also this on the Security SE https://security.stackexchange.com/questions/23256/what-is-the-http-server-response-header-field-used-for

But keep in mind that this is not an end-all to securing your servers. Just one more step in the right direction. It does not prevent any hack to be executed. It just make it less visible as to what hack should be performed.

2
  • 6
    Removing file name extensions in URLs has nothing to do with security... it's more readable for humans. There are a thousand other ways your application platform is revealed.
    – Brad
    Mar 6, 2014 at 16:09
  • If server is configured properly, revealing platform to wanna-be attacker will not help him anyway.
    – Cthulhu
    Mar 7, 2014 at 12:47
19

You can change the Server header if you want, but don't count on this for security. Only keeping up to date will do that, since an attacker can just ignore your Server header and try every known exploit from the beginning of time.

RFC 2616 states, in part:

Server implementors are encouraged to make this field a configurable option.

And Apache did, with the ServerTokens directive. You can use this if you wish, but again, don't think that it's going to magically prevent you from getting attacked.

5
  • 4
    +1 My logs are full of "attacks" for software that isn't installed. Hackers just throw everything they've got and see what sticks. If there's any utility in changing the ServerTokens, it's negligible at best.
    – Chris S
    Mar 6, 2014 at 15:49
  • @ChrisS Indeed. I don't even bother; I keep my web servers up to date instead. Mar 6, 2014 at 15:50
  • 3
    I kind of disagree. While it may be minor, security is never strong enough, and anything that can help without bringing flaws or decreasing performances has to be enforced.
    – mveroone
    Mar 6, 2014 at 16:01
  • 2
    Why volunteer version information? I always set "ServerSignature Off" and "ServerTokens Prod". Also agree that keeping your web servers up to date is the only real protection. If you don't remove the version information and submit to a third-party penetration test they are sure to flag this as "Information Leakage".
    – HTTP500
    Mar 6, 2014 at 16:26
  • @HTTP500 I deal with PCI-DSS compliance on a regular basis. This is a complete non-issue, provided you're patched up. Where it becomes an issue is when it leaks information about other parts of the system (i.e. I can tell the OP is running CentOS 5.x) or you didn't keep up to date. Mar 6, 2014 at 16:44
2

Showing the full string, with version information, could leave you at an increased risk from 0day attacks if the attacker has been keeping a list of which servers run what software.

That being said, you shouldn't expect that hiding a server string will protect you from hacking attempts. There are ways to fingerprint a server based on the way responses and errors are reported.

I disable my strings, as far as I can but I don't sweat about the ones I can't hide (e.g. OpenSSH).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .