View previous topic :: View next topic |
Author |
Message |
trossachs Veteran


Joined: 22 Jan 2004 Posts: 1204 Location: London
|
Posted: Sat Sep 11, 2004 9:50 am Post subject: [CLOSED] Apache 'not found display' (looking to be hidden) |
|
|
If someone mistypes a URL onto my box, Apache will display the 'Not Found' sign and also print out the Apache, PHP and FrontPage version details. How can this be omitted on security grounds? thx.
Last edited by trossachs on Wed Oct 06, 2004 6:26 am; edited 1 time in total |
|
Back to top |
|
 |
nobspangle Veteran


Joined: 23 Mar 2004 Posts: 1318 Location: Manchester, UK
|
Posted: Sat Sep 11, 2004 10:45 am Post subject: |
|
|
I think this info is in the http headers anyway but, two ways,
Supply custom error pages
in commonapache2.conf turn off ServerSignature |
|
Back to top |
|
 |
trossachs Veteran


Joined: 22 Jan 2004 Posts: 1204 Location: London
|
Posted: Sat Sep 11, 2004 1:17 pm Post subject: |
|
|
I do not have a commonapache2.conf file. Can I add your directive to the apache2/httpd.conf file instead? |
|
Back to top |
|
 |
nobspangle Veteran


Joined: 23 Mar 2004 Posts: 1318 Location: Manchester, UK
|
Posted: Sat Sep 11, 2004 1:43 pm Post subject: |
|
|
yes that's fine,
Code: | ServerSignature off |
I have the new style split config files. You might want to grep the file to check it's not already set to on. |
|
Back to top |
|
 |
hanj Veteran


Joined: 19 Aug 2003 Posts: 1500
|
Posted: Sat Sep 11, 2004 1:48 pm Post subject: |
|
|
I would also edit the conf.. and add/edit this:
hanji |
|
Back to top |
|
 |
trossachs Veteran


Joined: 22 Jan 2004 Posts: 1204 Location: London
|
Posted: Sat Sep 11, 2004 2:51 pm Post subject: |
|
|
Why would I do this hanj? |
|
Back to top |
|
 |
hanj Veteran


Joined: 19 Aug 2003 Posts: 1500
|
Posted: Sat Sep 11, 2004 3:05 pm Post subject: |
|
|
Quote: | Making Apache Offer Less Config Information Hide the version number from attackers to make version scanners and potentially worms fail.
ServerSignature Off
Hide the list of modules and other status information from an attacker:
ServerTokens Prod |
I would recommend reading this:
http://www.bastille-linux.org/jay/Talks/slides-defcon-securing-apache.pdf
hanji |
|
Back to top |
|
 |
trossachs Veteran


Joined: 22 Jan 2004 Posts: 1204 Location: London
|
Posted: Wed Oct 06, 2004 6:26 am Post subject: |
|
|
Will read up, thanks. |
|
Back to top |
|
 |
|