How can I configure apache to not reveal the version?

[Michael Tully]

Hi,

I am trying to secure a server on the outside of my firewall. In an audit that was conducted of this server it was identified that the my host reveals the apache version. Can anybody tell me what I can do in order to fix this problem?

There was a bulletin from apache 10.14 of RFC
1945 suggests it is configurable. To me it is
written in goobledegook....

TIA
-Michael

[harry d brown jr]

Michael,

You know that that was written in 1996.

I'll try to find it, because I think I changed one of mine to look like a M$ server, really pisses hackers off when they go down the wrong path.


live free or die
harry

[Jeffrey S. Sims · Accepted solution]

Michael,

I am not sure if this is what you are looking for but in the httpd.conf file there is a section that reads:

#
# Optionally add a line containing the server version and virtual host
# name to server-generated pages (error documents, FTP directory listings,
# mod_status and mod_info output etc., but not CGI generated documents).
# Set to "EMail" to also include a mailto: link to the ServerAdmin.
# Set to one of: On | Off | EMail
#
ServerSignature Off

If you make sure that this is set to off, it will not announce the server version on server generated pages.

Hope this helps

[Michael Tully]

Harry,

It didn't matter when it was written, it was
still written so that the normal dill like me
couldn't understand it.... :^))

Thanks Jeff, changing that line fixed the
problem. All I had to do then was to stop and
restart the apache server.

Problem solved!!!

Cheers
-Michael

[Michael Tully]

Harry,

I like to piss hackers off too, let me know if you find it.

Cheers
Michael