quietearth [General News 10.11.06]



By default, most pre-packaged apache installations come with full information leakage, so if you telnet to port 80 on your webserver you can check, just type in the GET line, then hit enter twice:
# telnet localhost 80
Trying 127.0.0.1...
Connected to localhost.localdomain.
Escape character is '^]'.
GET / HTTP/1.1

HTTP/1.1 400 Bad Request
Date: Wed, 11 Oct 2006 19:13:43 GMT
Server: Apache/2.0.55 (Ubuntu) PHP/5.1.2
Content-Length: 226
Connection: close
Content-Type: text/html; charset=iso-8859-1


Here we see the Apache version, the distro, and the php version. If you had any extra apache modules installed, it would also show them as well as their versions. We can easily fix this by modifying the config file which will be distribution dependent. On Ubuntu its /etc/apache2/apache2.conf, or on red hat enterprise linux it will be /etc/httpd/conf/httpd.conf. We will need to modify the ServerSignature and ServerTokens lines, if you don't have them, add them in. Here's what they should be set to:
ServerSignature Off
ServerTokens Prod

Now restart the webserver and check what info we have:
# telnet localhost 80
Trying 127.0.0.1...
Connected to localhost.localdomain.
Escape character is '^]'.
GET / HTTP/1.1

HTTP/1.1 400 Bad Request
Date: Wed, 11 Oct 2006 19:16:07 GMT
Server: Apache
Content-Length: 226
Connection: close
Content-Type: text/html; charset=iso-8859-1

All it says now is Apache. PHP also has version information leakage turned on.
By default when php serves a page your header will show:
X-Powered-By: PHP/4.X.X

You need to modify the php.ini and set the expose_php variable to Off. For ubuntu, the file is /etc/php5/apache2/php.ini. This will remove the X-Powered-By line.
expose_php = Off
Another problem in php could be display_errors, you want this turned off for a production web site because it might provide file paths or other informaiton.
display_errors = Off

After making any php.ini modifications, you will need to restart apache for them to take affect.

If you are using any other modules with apache, you will need to check the documentation.

Leave a comment

Your Comment

Related articles