数学建模社区-数学中国

标题: 如何叫你的apache不回显版本 [打印本页]

作者: 韩冰 时间: 2004-10-5 18:21
标题: 如何叫你的apache不回显版本

作者：Yiming Gong & @1 W9 W# x- thttp://security.zz.ha.cn

默认情况下apache是会给client端回显版本号码的，可以测试如下,在client端使用nc联接起着apache的目的主机80端口，发送错误的get请求

yiming# nc security.zz.ha.cn 80 * D2 k0 d$ P W3 k: [" gget index.lakdsjf/ \# y4 X' A t3 M7 i; E1 ? <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">7 l( F$ y2 B9 {# g <html><head> + `6 ], H' A) q3 w6 v9 _. z<title>400 Bad Request</title> / P* h0 y5 B" H) \% [</head><body> ; N% E4 g: m9 j2 R+ ^7 [<h1>Bad Request</h1> ; M; b" n% a4 F Z0 n( N$ o% l6 Q<p>Your browser sent a request that this server could not understand.<br /> 8 p4 ]& y& g6 k6 {7 x+ {+ J6 |</p> 9 A" F: q$ W2 l, K" ]1 c5 M<hr />: o& h' ?; F. N) V <address>Apache/x.y.z Server at security.zz.ha.cn Port 80</address> 9 p$ m3 W* y/ @: h0 c</body></html>

$ ?/ C4 m0 B) j- S我们看到上面显示了apache的版本号（：）俺隐去了真实版本），这可不太好，能修改一下么？/ k8 _; K c% j: g& |1 }( c5 d 答案是肯定的！ 1 }$ n3 ~% L" G8 x6 ]; X; E改动apache的配置文件，找到ServerTokens和ServerSignature两个directive,修改默认属性： % Y8 N7 r: x: ?如下

# and compiled in modules., L/ M/ K6 d3 b+ `# K # " I6 g5 r9 P& Y" v( K# ServerTokens 0 T4 |/ T" [9 f" g( r9 p# This directive configures what you return as the Server HTTP response / v' h, G. W& H! U# Header. The default is 'Full' which sends information about the OS-Type 2 D4 m) \ U# k# and compiled in modules. : ]6 _) ~% g1 S% d# y# Set to one of: Full | OS | Minor | Minimal | Major | Prod B3 C1 U x* d! o # where Full conveys the most information, and Prod the least. 9 Y/ \* r W1 {# o# 3 H# |9 E" P# y5 M#ServerTokens Full. {% e' N1 m( X" z0 O ServerTokens Prod

#% w* |1 _3 a, z' r% B A # Optionally add a line containing the server version and virtual host' X4 J& V* s3 t% K # name to server-generated pages (internal error documents, FTP directory3 F# M9 j4 d& a0 v9 \3 X # listings, mod_status and mod_info output etc., but not CGI generated1 ^, K N( H! R" M # documents or custom error documents).5 E5 o- I) E J% b( M4 _6 w # Set to "EMail" to also include a mailt link to the ServerAdmin.! W( \( L8 x f7 j7 M) U9 i # Set to one of: On | Off | EMail6 ~4 z# T+ P0 W& s$ F6 F T # ) g! w. l3 P4 H: e: SServerSignature On ) b& _" N" |6 b7 \ServerSignature Off

修改后重起apache，再看看， & m$ e/ g2 p+ M( b/ _yiming# nc security.zz.ha.cn 80# q6 w$ H, V, {( K! `$ b4 Z+ a: R" [ get index.lakdsjf : N. S0 H: p" k% T$ W<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> * d& a+ t+ U& J6 k: `<html><head> 5 T# j6 G+ ]1 R& [! F2 O* v<title>400 Bad Request</title> * ^& L! L& l+ o; ~: U</head><body>- M5 ]) i4 U, S/ s" z' z1 D* M7 a <h1>Bad Request</h1> + |' ~/ L0 j$ K/ H<p>Your browser sent a request that this server could not understand.<br />5 m( g/ N) f' l3 V& ^ </p> / i! b0 E% q: P7 d9 ]* |" V</body></html>

, u: h4 j5 [1 q

欢迎光临数学建模社区-数学中国 (http://www.madio.net/)