67

I don't want anyone to be able to detect that I'm using NGINX or even Ubuntu from the internet. There are tools out there (such as BuiltWith) which scan servers to detect what tools they're using. Also, some cracking tools might help with deteting. What's the best / closest to that I can get to hiding all this info from the outside?

101

You can stop it outputting the version of Nginx and OS by adding

server_tokens off;

to a http, server, or location context.

Or if you want to remove the Server header completely, you need to compile Nginx with the Headers More module in, as the header is hard coded in the Nginx source, and this module allows changing any http headers.

 more_clear_headers Server;

However, there are many hidden ways servers perform by accident via their implementation which may help identify the system. e.g. How it responds to a bad SSL request. I don't see a practical way of preventing this.

Some of the things I might suggest:

  • change error templates
  • block all ports except the services needed
  • 13
    Agreed. Look at nmap's OS detection for instance - this looks at the target hosts's responses to IP/TCP requests and is able to determine the OS that way. It's really not worth putting effort into this. – EEAA Dec 19 '10 at 21:52
  • 6
    +1 on ErikA's advice. Better to secure your server as best as you can rather than relying on security through obscurity. – Andy Smith Dec 19 '10 at 21:54
  • 4
    Server tokens only turn off the version number. Nginx does not allow for completely removing the header. – Martin Fjordvald Dec 20 '10 at 18:46
  • 40
    disregarding important security factors like "no version numbers" and probably even "no server vendor name" entirely is just ... a beginners mistake. Of course security through obscurity does nothing for your security itself but it sure as hell will at least protect against the most mundane, simplistic attack vectors - security through obscurity is a necessary step, it may be the first one and should never be the last security measurement -skipping it completely is a very bad mistake, even the most secure webservers can be cracked if a version-specific attack vector is known. – specializt Apr 27 '15 at 14:23
  • 1
    There is a still an annoying server name "Nginx" returned in the body of a 301 redirect response and found no way to avoid that so far, the rule to use a custom html template does not work for 301. – Guillaume Perrot Feb 17 '16 at 3:30
23

If you have installed nginx using apt-get in Debian or Ubuntu, you might need to install the package nginx-extras to set or clear "Server" header

Once this is done, you can add the lines below in nginx.conf (usually /etc/nginx/nginx.conf):

To clear the "Server" header altogether:

more_clear_headers Server; 

To Set a custom string as "Server"

more_set_headers 'Server: some-string-here';
  • 1
    Confirmed more_clear_headers Server; works as well on Debian Jessie 8.5 nginx version: nginx/1.6.2 – Brandon Jul 21 '16 at 19:54
  • This answer needs more upvotes. Although perhaps it should be noted that the directive needs to be placed inside the http block of the conf file (I think) – Andy Oct 25 '16 at 20:41
  • 2
    This works in http, server, location, and location if contexts. Source: ngx_headers_more documentation – Kelvin Nov 18 '16 at 14:09
17

@Martin F. Yes it does. You will have to compile it from source and change what's needed before compiling the source.

I assume you downloaded the last stable version you decompressed it and you know where the files are. If that's the case, do the following:

nano src/http/ngx_http_header_filter_module.c

Then look for line 48 if I recall correctly.

static char ngx_http_server_string[] = "Server: nginx" CRLF;

Replace nginx with MyWhateverServerNameIWant e.g.

static char ngx_http_server_string[] = "Server: MyWhateverServerNameIWant" CRLF; 

Then

nano src/core/nginx.h 

look for the line

#define NGINX_VER          "nginx/" NGINX_VERSION

change "nginx/" to "MyWhateverServerNameIWant/" so it will read

#define NGINX_VER          "MyWhateverServerNameIWant" NGINX_VERSION

Finally if you want also change the version number

look for the line #define NGINX_VERSION "1.0.4"

and change "1.0.4" for whatever version you want. For example it will read

#define NGINX_VERSION      "5.5.5"

Hope it helps. Nevertheless. Securing a server goes far beyond not showing what's running. PHP is by nature insecure, and so is linux. Off course linux can be pretty secure if all needed measures are taken in order to achieve a decent security. As far as PHP is concerned I would recommend using Suoshin to help harden the security of your code.

  • 4
    +1, thanks. I'm leaving @Andy's as the official, just due to the easier approach, but this is excellent information. – orokusaki Jun 12 '11 at 2:47
  • I think you mean Suhosin. – Beetle Feb 29 '16 at 10:33
7

After a lot of time working out how to do a custom flavor of nginx on ubuntu I realized you can use the lua module for this.

On ubuntu 14.04 if you install the nginx-extras package you can remove the server header by using:

header_filter_by_lua 'ngx.header["server"] = nil';

Throw this in the http block and every request will be lacking a Server header.

If it doesn't work run nginx -V to verify that you have the lua module compiled into your copy of nginx. If not, there is likely an alternate package you can use to get it.

  • Confirmed this works on Debian Jessie 8.5 nginx version: nginx/1.6.2 – Brandon Jul 21 '16 at 19:52
  • 1
    On debian testing this doesn't seem to work BUT installing nginx-extra made more_set_headers "Server: whatever"; work, so +1 :D – Shautieh Sep 15 '16 at 7:07
  • You only need LUA enabled for this to work. Tnx – glavić Sep 2 '18 at 13:50
6

Instead of the header_filter_by_lua it is recommended to use the new directive header_filter_by_lua_block which inlines the Lua source directly between curly braces ({}). With this it is not needed to escape special characters.

header_filter_by_lua_block { ngx.header["server"] = nil }

https://github.com/openresty/lua-nginx-module#header_filter_by_lua_block

1

First and foremost: Why using an extra module as Headers More Nginx? Only to hide the server header. If a few lines, simple patch can reach the same solution for you.

As using an extra module could result in instability (how well has it been tested with your environment? With your other modules etc.) or insecurity (is this module regularly updated with bug and/or security related fixes?)

Secondly. This thread describes as reply 279389 how you can adjust the Nginx code to change the server header. Problem is that they have forgotten HTTP/2. In short, nothing will change. The server header will still be visible.

Less is more is better. Ok I admit, I have also been looking for a good solution for a long time. But finally found:

Nginx server header removal patch

I am finally redeemed from that annoying Nginx server header.

0

Run this bash function in nginx source code folder. In nginx-$version, not in src/.

Based on this answer.

hidengxver () {
read -r -p "Your own http_server_string for safety: " http_server_string
first_string="static char ngx_http_server_string\[\] = \"Server: nginx\" CRLF;"
second_string="static char ngx_http_server_string\[\] = \"$http_server_string\" CRLF;"
sed -ire "s/$first_string/$second_string/g" src/http/ngx_http_header_filter_module.c

read -r -p "Your own NGINX_VER const: " nginx_ver
third_string="\#define NGINX\_VER          \"nginx\/\" NGINX\_VERSION"
forth_string="\#define NGINX\_VER          \"$nginx_ver\" NGINX\_VERSION"
sed -ire "s/$third_string/$forth_string/g" src/core/nginx.h

real_nginx_version=$( grep '#define NGINX_VERSION' src/core/nginx.h | gawk -F'"' '{print $2}' )
read -r -p "Your own NGINX_VERSION const: " new_nginx_version
fifth_string="\#define NGINX\_VERSION      \"$real_nginx_version\""
sixth_string="\#define NGINX\_VERSION      \"$new_nginx_version\""
sed -ire "s/$fifth_string/$sixth_string/g" src/core/nginx.h
}
-1

Refer to this gist. Surely will help you.

  • 8
    Welcome to Server Fault! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – Gerald Schneider Jun 2 '17 at 9:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.