1

I'm trying to do something I thought was simple. I just want to change the Server header that Apache sends for every request. This is the line in my httpd.conf file:

Header always set Server "My Server name"

However, this is what is returned in the Server header:

Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.10 with Suhosin-Patch mod_ssl/2.2.8 OpenSSL/0.9.8g

Incidentally, that's what software I'm using (how convenient). I do have mod_headers enabled and it is working for other directives in my configuration files.

EDIT: I'm running this on Ubuntu Server 8.04 LTS x64.

Why doesn't this work?

4

That's because it's an Apache policy not to lie about the Server header and to always set it. The best you can do is to have it only display "Apache" with :

ServerSignature Off
ServerTokens Prod

As it's said in the FAQ and a bug report, the only way you can have Apache send "My Server Name" is to modify the sources.

Note also that you won't gain anything by having your server not saying you're using Apache, security through obscurity is, well, not really security. If you're trying to hide your operating system or your php or ssl versions, in case a bug arise, it's not really useful either because people tend to try getting into every server they encounter.

  • Thanks for the link to the bug report. Very informative. I've already set the ServerSignature and ServerTokens settings. I was just hoping for a custom Server header. I already know all the talk about security, etc. This was/is for branding purposes. – Andrew Ensley Feb 17 '10 at 16:09
0

Below just hides the information OS version and Apache server version.

    ServerSignature Off
    ServerTokens Prod

To completely obfuscate server information add use mod_headers module

    LoadModule headers_module lib64/httpd/modules/mod_headers.so

following at the end of httpd.conf (after all other config)

    <IfModule headers_module>
        Header set server "anything"
    </IfModule>
  • I asked this question quite a while ago, so my environment is long gone. When I asked this, I did have mod_headers enabled/loaded, and it was working for other directives in my configuration files. The problem was that the default Apache binaries do not allow overriding the Server header, as @mat mentioned. In order to override that header, Apache has to be compiled from source. – Andrew Ensley Aug 7 at 15:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.