Apache information leak

rino.caldelli · 12-06-2005, 11:58 AM

when I visit an inexistent page on my server I get the 404 Error and a full list of my software:

[HTML]Not Found

The requested URL /l was not found on this server.
Apache-AdvancedExtranetServer/2.0.53 (Mandrakelinux/PREFORK-9mdk)
mod_ssl/2.0.53 OpenSSL/0.9.7e PHP/4.3.10 mod_perl/1.999.21
Perl/v5.8.6 Server at 127.0.0.1 Port 80[/HTML]

why is it and what apache.conf should I edit?????

bathory · 12-07-2005, 05:08 AM

This is usually in httpd.conf. Edit this file and change (or add) the following lines:

Code:

ServerSignature Off
ServerTokens Prod

or create a custom error page to show when a 404 error occurs and uncomment the respective line of httpd.conf.

rino.caldelli · 12-09-2005, 07:17 AM

ok now it doesn't show the version of my software anymore... but how do I change the default error pages???? editing those under /var/www/error/ doesn't work!

thanks

bathory · 12-09-2005, 08:17 AM

You must first uncomment the line:

Code:

ErrorDocument 404

in the apache httpd.conf and then customize the error page you want.