注册
登录
| 关键词： server apache security ServerTokens documents 版本 ServerSignature Yiming information RequestYour |
作者：Yiming Gonghttp://security.zz.ha.cn 默认情况下apache是会给client端回显版本号码的，可以测试如下,在client端使用nc联接起着apache的目的主机80端口，发送错误的get请求 yiming# nc security.zz.ha.cn 80get index.lakdsjf<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr /><address>Apache/x.y.z Server at security.zz.ha.cn Port 80</address></body></html> 我们看到上面显示了apache的版本号（：） 俺隐去了真实版本），这可不太好，能修改一下么？答案是肯定的！改动apache的配置文件，找到ServerTokens和ServerSignature两个directive,修改默认属性：如下 # and compiled in modules.## ServerTokens# This directive configures what you return as the Server HTTP response# Header. The default is 'Full' which sends information about the OS-Type# and compiled in modules.# Set to one of: Full | OS | Minor | Minimal | Major | Prod# where Full conveys the most information, and Prod the least.##ServerTokens FullServerTokens Prod ## Optionally add a line containing the server version and virtual host# name to server-generated pages (internal error documents, FTP directory# listings, mod_status and mod_info output etc., but not CGI generated# documents or custom error documents).# Set to "EMail" to also include a mailto: link to the ServerAdmin.# Set to one of: On | Off | EMail#ServerSignature OnServerSignature Off 修改后重起apache，再看看， yiming# nc security.zz.ha.cn 80get index.lakdsjf<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html> :) |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
