My server responds with Server: Apache/2.2.15 (CentOS) to all requests. I guess that this gives away my server architecture making it easier to hack attempts.

Is this ever useful to a web browser? Should I keep it on?

  • Obviously I'm keeping my servers updated with yum-cron also! – Nic Cottrell Mar 6 '14 at 16:40

In my opinion, it is best to mask this as much as possible. It's one of the tool you use to hack a web site - discover its technology, use the known flaws of that technology. The same reason why security best practice a while back started promoting to have urls in the form "/view/page" instead of "/view/page.jsp" or "/view/page.asp"... so the underlying technology would not be exposed.

There are some discussions about this such as https://stackoverflow.com/questions/843917/why-does-the-server-http-header-exist and http://www.troyhunt.com/2012/02/shhh-dont-let-your-response-headers.html and obviously Hacking Exposed book.

Also this on the Security SE https://security.stackexchange.com/questions/23256/what-is-the-http-server-response-header-field-used-for

But keep in mind that this is not an end-all to securing your servers. Just one more step in the right direction. It does not prevent any hack to be executed. It just make it less visible as to what hack should be performed.

| improve this answer | |
  • 6
    Removing file name extensions in URLs has nothing to do with security... it's more readable for humans. There are a thousand other ways your application platform is revealed. – Brad Mar 6 '14 at 16:09
  • If server is configured properly, revealing platform to wanna-be attacker will not help him anyway. – Cthulhu Mar 7 '14 at 12:47

You can change the Server header if you want, but don't count on this for security. Only keeping up to date will do that, since an attacker can just ignore your Server header and try every known exploit from the beginning of time.

RFC 2616 states, in part:

Server implementors are encouraged to make this field a configurable option.

And Apache did, with the ServerTokens directive. You can use this if you wish, but again, don't think that it's going to magically prevent you from getting attacked.

| improve this answer | |
  • 4
    +1 My logs are full of "attacks" for software that isn't installed. Hackers just throw everything they've got and see what sticks. If there's any utility in changing the ServerTokens, it's negligible at best. – Chris S Mar 6 '14 at 15:49
  • @ChrisS Indeed. I don't even bother; I keep my web servers up to date instead. – Michael Hampton Mar 6 '14 at 15:50
  • 3
    I kind of disagree. While it may be minor, security is never strong enough, and anything that can help without bringing flaws or decreasing performances has to be enforced. – mveroone Mar 6 '14 at 16:01
  • 2
    Why volunteer version information? I always set "ServerSignature Off" and "ServerTokens Prod". Also agree that keeping your web servers up to date is the only real protection. If you don't remove the version information and submit to a third-party penetration test they are sure to flag this as "Information Leakage". – HTTP500 Mar 6 '14 at 16:26
  • @HTTP500 I deal with PCI-DSS compliance on a regular basis. This is a complete non-issue, provided you're patched up. Where it becomes an issue is when it leaks information about other parts of the system (i.e. I can tell the OP is running CentOS 5.x) or you didn't keep up to date. – Michael Hampton Mar 6 '14 at 16:44

Showing the full string, with version information, could leave you at an increased risk from 0day attacks if the attacker has been keeping a list of which servers run what software.

That being said, you shouldn't expect that hiding a server string will protect you from hacking attempts. There are ways to fingerprint a server based on the way responses and errors are reported.

I disable my strings, as far as I can but I don't sweat about the ones I can't hide (e.g. OpenSSH).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.