Server Details - HTTP Header Information Security

This information is stored in http headers, and sent along with every web page request made by a user visiting your page. As a result, it is very easy for anyone to find out what kind of settings such a server is using.

By itself, this information is harmless, although it does give away some information about your website setup. A dedicated attacker can use this information to find and craft attacks specific to your system, or automated attacks may search for specific configurations to attack. Although it is difficult to prevent someone from finding this information using other methods, disabling server headers reduces the likelihood of attacks on the site.

A dedicated attacker can find out this information in a variety of ways, most of which cannot be easily prevented. By itself, this information provides little value to an attacker.

The most common use of this kind of information is automated attacks which search on Google for specific server configurations known to be vulnerable, or to automate attacks known to work against setups similar to what is found on the site. Removing these values form the server header will prevent these types of automated attacks from occurring.

Although it is not necessarily possible to completely prevent this knowledge from being discovered, it is possible to make it significantly more difficult for attackers. Each web server will require a different configuration change, but I provided the most common web server (Apache) configuration changes here. These changes will remove the HTTP headers which include server configuration and type information, increasing overall website security.

Modify Apache to prevent unwanted disclosure of server information:

To modify apache, there are a few steps which must be followed. You or a technical resource will need access to the Apache configuration file in the server, and a few moments to restart the web services after making a change.

1. Navigate to your httpd.conf file. This is often located in /etc/httpd/conf or /etc/apache2 or /etc/apache.
2. Open the config file using a text editor. On Unix systems, the most common one is vi (command: vi httpd.conf)
3. Find the line including ServerTokens (if using vi, you can find this quickly by typing in /ServerTokens)
4. If the line exists, update it to read ServerTokens Prod
5. If the line does not exist, add it to the bottom of the file
6. Make sure no other characters such as # (indicating a comment) are in front of the line
7. Find a line including ServerSignature in the same file
8. Update this line so it reads ServerSignature Off (Again, ensure no # sign)
9. If the line does not exist, you can add it to the end of the file
10. Save the configuration file (if in vi, the command is :wq)
11. Restart apache. Typically httpd restart

Golem Technologies includes numerous different server setting scans to help you reduce your exposure to attack with thorough security scanning, including application server setup. See how the Golem Scan can help your business today.