viewing server signature

tkmsr · 10-25-2010, 02:26 AM

How can I view server signature on my website.

bathory · 10-25-2010, 02:48 AM

Hi,

What server?
For apache turn "ServerSignature On" in httpd.conf.
Then point your browser to a non existent page and you'll see it under the error message.

Regards

anon237 · 10-25-2010, 02:49 AM

Hi,

Assuming you use Apache:

Are you looking for the ServerTokens <TOKEN> directive?

ServerTokens Directive (Apache 2.2)

Hope this helps.

Maybe I got it wrong and you need this one: ServerSignature Directive (Apache 2.2)

tkmsr · 10-25-2010, 04:27 AM

Quote:

Originally Posted by bathory

Hi,

What server?
For apache turn "ServerSignature On" in httpd.conf.
Then point your browser to a non existent page and you'll see it under the error message.

Regards

I am using Ubuntu 10.04 and httpd.conf is blank I also checked apache2.conf and ServerSignature is not present then
/etc/apache2/conf.d/security
here I found

Code:

#ServerTokens Minimal
ServerTokens OS
#ServerTokens Full

as you said to point to a non existent page I did the same but I did not found any thing from it.

Noway2 · 10-25-2010, 04:50 AM

Ubuntu differs from most distributions in that it does not make use of the httpd.conf file. Instead the configuration is mostly done in apache2.conf. Ports.conf is used to configure a few things and then the rest of it is done in your host declaration under the sites-enabled directory.

bathory · 10-25-2010, 05:23 AM

If it doesn't exist you can add it in /etc/apache2/apache2.conf or in /etc/apache2/conf.d/security along with the ServerTokens.
By default (if it doesn't exist) ServerSignature is off, that's why you don't get anything in an error page.
Note that's it's better to keep it to off, so you don't reveal your server version, OS etc

Regards

tkmsr · 10-25-2010, 09:11 AM

Quote:

Originally Posted by bathory

By default (if it doesn't exist) ServerSignature is off, that's why you don't get anything in an error page.
Note that's it's better to keep it to off, so you don't reveal your server version, OS etc

Yes I understand your point.
I have to test an LMS known as Ilias as given here
the absolutely last lines of the above link

Code:

Currently is not possible to run ILIAS with the default Suhosin settings.
Please enter the following line in your php.ini if this patch is activated:
suhosin.session.encrypt=Off
suhosin.post.max_vars=10000
suhosin.request.max_vars=10000

were the ones which made my work impossible so I needed to know what Server Signature was if you know any alternative then share.

bathory · 10-25-2010, 12:18 PM

OK, so you want the ServerSignature to see if you have the php suhosin patch?
Did you try to add the directive and see what you get in an error page.
An alternative is to check the lines written in apache error_log when apache is restarting.