ServerTokens Directive Apache with SLOX4.1

sln · 05-31-2005, 02:01 AM

Hello:

I am trying to reduce the amount of information given out when someone tries
to Banner Grab for Version information. I read that "ServerToken" directive
in httpd.conf file will limit the amount of information given out. First off
I didn't find the "ServerToken" in the httpd.conf with a search. So I
added it in the Global Setting section (where I found it on RedHat box).
Set it to "ServerToken Prod" or "OS" or "Min" no quotation marks of course. I found
"ServerSignature On" changed it to "Off", restarted httpd, and then ran "HEAD /
HTTP/1.0" and it still comes back with

HEAD / HTTP/1.0
200 OK
Content-Length: 720
Content-Type: text/html
Last-Modified: Wed, 11 May 2005 20:16:21 GMT
Client-Date: Tue, 31 May 2005 04:49:32 GMT

404 Not Found
Date: Tue, 31 May 2005 04:31:44 GMT
Server: Apache/2.0.49 (Unix) PHP/4.3.9 # How do I get rid of this an say something else
Content-Length: 1335
Content-Type: text/html; charset=ISO-8859-1
Client-Date: Tue, 31 May 2005 04:49:33 GMT
Client-Response-Num: 1
Proxy-Connection: close
X-Cache: MISS from firewall.domainname
X-Powered-By: PHP/4.3.9 # How do I get rid of this and say something else

I guess my question should be what controls the amount of information given out ServerTokens, ServerSignature, or something else? And to configure these items do I make my changes in the httpd.conf, or httpd.conf.SuSEconfig, or in /etc/sysconfig/apache? Which file and variable controls what gets displayed. I have made changes to SeverTokens and ServerSignature in httpd.conf and httpd.conf.SuSEconfig, and HTTPD_SEC_SAY_FULLNAME directive to "no" in /etc/sysconfig/apache at different times and then restarted the httpd with rchttpd restart, and then did the "HEAD / HTTP/1.0" from the command line and I always get the above with no changes.

What AM I DOING WRONG?

Any help here would be appreciated.

Thanks:
Steve

bulliver · 05-31-2005, 12:52 PM

I don't know what to tell you. On my system I have only:

Code:

ServerTokens Prod
ServerSignature Off

In httpd.conf, and all I get is:
Server: Apache

I would suggest finding out which conf file is the actual one being used, and double check that you don't have the directives written in there twice, cancelling each other out...

As far as what each directive does, ServerTokens decides how much info is in the header, and ServerSignature decides how much info is in server-generated pages such as 404 pages etc...

To turn off php reporting in the header edit php.ini and look for:

Code:

; Decides whether PHP may expose the fact that it is installed on the server
; (e.g. by adding its signature to the Web server header).  It is no security
; threat in any way, but it makes it possible to determine whether you use PHP
; on your server or not.
expose_php = Off