Whenever any request is made from client to server then it sends some headers from server to client or vice versa. So when we receive server response we get some headers that give some extra information about the server.
This information or headers sometimes becomes vulnerable for hackers to break your server and get into it. In order to stop unauthorized access we secure our server.
So in this article “Server Security – Apache Web Server Hardening” I will secure the apache server by removing the server details from response headers. This comes under the Banner Grabbing Attack.
In the Banner Grabbing method, Hacker tries to identify the target system OS or server name and version to penetrate into the system.
To understand this look at the image below.
If you will look at the image you will find out, In server response headers we are actually getting the lots of details.
We are getting the following items:
1. Server Name and Version (Apache & 2.4.43)
2. OS Name (Win64)
3. Web Language Name and Version (PHP & 7.3.17 )
The above information is big enough to carry out attacks on your server.
Prevention:
So in order to prevent this attack the best way is to remove this sensitive information from response headers. To do this you have to make changes in httpd.conf file. This file basically the configuration file of your server.
You may find httpd.conf file on following location
Ubuntu – /etc/apache2
Cent OS – /etc/httpd/conf
Windows – wamp/apache2/conf/
Steps:
- Open httpd.conf file
- Then search for “ServerTokens” and set its value to Prod. If it does not exist then add it at the end of the file.
- Save the file.
- Restart the server.
Note: In an earlier Apache version before 2.0.44, you have to set the “ServerSignature” value to On in order to achieve the same.
Version < 2.0.44
ServerSignature Off
ServerTokens Prod
Version > 2.0.44
ServerTokens Prod
Server Tokens Directive
Server Token has 5 Possible values
ServerTokens Prod[uctOnly]
Server sends (e.g.): Server: Apache
ServerTokens Major
Server sends (e.g.): Server: Apache/2
ServerTokens Minor
Server sends (e.g.): Server: Apache/2.0
ServerTokens Min[imal]
Server sends (e.g.): Server: Apache/2.0.41
ServerTokens OS
Server sends (e.g.): Server: Apache/2.0.41 (Unix)
ServerTokens Full (or not specified)
Server sends (e.g.): Server: Apache/2.0.41 (Unix) PHP/4.2.2 MyMod/1.2
Server Signature Directive
The ServerSignature appears on the bottom of pages generated by apache such as 404 pages, directory listings, etc.
Now after version, 2.0.44 ServerToken directive can control both
Suggested Read: Play Playstation 3 Games on PC
Comments
Post a Comment