Linux Ask a question: How to turn off server signing on Apache Web server

issue : Whenever the APACHE2 site server returns an error page (for example, 404 page cannot be found, 403 Forbidden page), it displays the site server signature (for example, Apache version number and operating system information) at the bottom of the page. At the same time, when the Apache2 Web server is serving PHP pages, it will also display PHP version information. How do I turn off these Web server signatures on the APACHE2 Web server?

Disclosing the signature of a Web server with server/php version information poses a security risk because you basically tell the attacker about a known vulnerability on your system. Therefore, as a part of server hardening, it is highly recommended that you disable all site server signatures.

Disable Apache Web server signature

Disabling the Apache Web server signature can be done by editing the Apache configuration file.

On Debian,ubunt or Linux mint:

1. $ sudo vi /etc/apache2/apache2. conf

On Centos,fedora,rhel or Arch Linux:

1. $ sudo vi /etc/httpd/conf/httpd. conf

Add the following two lines to the bottom of the Apache configuration file.

Serversignature OFF

Servertokens Prod

Then restart the Web server for the changes to take effect:

2. $ sudo service apache2 restart (Debian, Ubuntu or Linux Mint) /c11>
4. $ sudo service httpd restart (CentOS/RHEL 6)
6. $ sudo systemctl restart httpd. Service (Fedora, CentOS/RHEL 7, Arch Linux)

The first line of ' Serversignature Off ' causes the Apache2 Web server to hide Apache version information on all error pages.

However, without the second line of ' Servertokens Prod ', the Apache server will still contain a detailed server tag in the HTTP response header, which will leak the Apache version number.

The second line of 'servertokens Prod' is to compress the server tags to a minimum in the HTTP response header.

Therefore, when two rows are placed at the same time, Apache will not leak version information in the page or in the HTTP response header.

Hide PHP Version

Another potential security threat is the PHP version information leak in the HTTP response header. By default, the Apache Web server contains PHP version information through the "x-powered-by" field in the HTTP response header. If you want to hide the PHP version in the HTTP header, open the php.ini file with a text editor and find the "expose_php = on" line and change it to "expose_php = Off".

On Debian,ubunt or Linux mint:

1. $ sudo vi /etc/php5/apache2/php. INI

On Centos,fedora,rhel or Arch Linux:

1. $ sudo vi /etc/php. INI

expose_php = Off

Finally, restart the Apache2 Web server to reload the updated PHP configuration file.

Now you will no longer see the HTTP response header with the "x-powered-by" field.

More wonderful Linux video tutorials at 51CTO Academy: http://edu.51cto.com/course/courseList/id-48.html

Linux Ask a question: How to turn off server signing on Apache Web server