Apache version info

hama · n00b Joined: 17 Jan 2004 Posts: 42

Is it possible to change what Apache tell about server:

Apache/2.0.48 (Gentoo/Linux) mod_ssl/2.0.48 OpenSSL/0.9.6k PHP/4.3.4 Server at domain.com Port 80

I like to change: "Gentoo/Linux" to "MS Windows IIS" =)

Earthwings · Posted: Tue Jan 20, 2004 7:37 pm Post subject:

Nearly everything is possible in Gentoo, but advanced features like this are only included in Microsoft Linux.

kashani · Posted: Tue Jan 20, 2004 7:39 pm Post subject:

Check these
http://nlug.org/mail/nlug__2001_07/0221.html
http://httpd.apache.org/docs/mod/core.html#serversignature

I thought there was a way to change the server sig using only the serversig confug line, but apparently not.

kashani
_________________
Will personally fix your server in exchange for motorcycle related shop tools in good shape.

UberLord · Posted: Wed Jan 21, 2004 12:58 am Post subject:

You should always have the ServerTokens directive to ProductOnly as this only advertises that it's an Apache server. No OS, version or module info is exposed.

There are other ways to tell if it's an Apache, IIS, etc server so this is harmless and good

If the version or modules were exposed then an attack is easier as the attacker knows weakness in the version.

soulwarrior · Guru Joined: 21 Oct 2002 Posts: 331

I think this only helps to hide the Apache version from simple scan attempts, as there exists tools like httprint, which can perform webserver fingerprinting with several criterias comparable to the os-fingerprinting from nmap.