查看: 6809|回复: 0

如何叫你的apache不回显版本

字体大小: 正常放大

韩冰

823 主题	3 听众	4048 积分

我的地盘我做主

该用户从未签到

电梯直达

1^#

发表于 2004-10-5 18:21 |只看该作者 |倒序浏览

|招呼Ta 关注Ta

作者：Yiming Gong; L s; j: y7 j% x( r) B/ s# y0 a http://security.zz.ha.cn

默认情况下apache是会给client端回显版本号码的，可以测试如下,在client端使用nc联接起着apache的目的主机80端口，发送错误的get请求

yiming# nc security.zz.ha.cn 80 + N4 V8 @& s0 T8 j7 }! ]4 @get index.lakdsjf 4 ]: V& N9 W. H3 K1 Q<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">' M( p/ F5 r5 h3 C% k* c" U7 q <html><head> ( p4 P5 U& r% D) ^<title>400 Bad Request</title>, P% U4 U9 ~) e0 f4 V% w </head><body> 9 i- q/ j0 l: _0 l* K<h1>Bad Request</h1>! k" q9 M" D7 ?7 U7 E <p>Your browser sent a request that this server could not understand.<br /> * V% G- x+ U5 G9 `# P: C5 F( }</p> : T$ Z H8 G3 {3 d9 F/ K0 }7 v<hr />+ z4 [- T# O5 p) j <address>Apache/x.y.z Server at security.zz.ha.cn Port 80</address>% z8 l. ^* r' O, y$ R7 F! d </body></html>

3 m- E+ I6 R; x% _我们看到上面显示了apache的版本号（：）俺隐去了真实版本），这可不太好，能修改一下么？' i. @% D1 @2 g9 x0 I7 W5 P 答案是肯定的！5 t7 O' r+ K d& D6 v4 B 改动apache的配置文件，找到ServerTokens和ServerSignature两个directive,修改默认属性： 5 P1 \$ V# g% A. L如下

# and compiled in modules.; y! @0 q3 L# l2 \' T, l4 T # : [4 G; x4 `! l3 x; t+ Z( A# ServerTokens " v+ Q. E) U* p# C2 I: ?( X# This directive configures what you return as the Server HTTP response . r0 S9 X; f k x y# Header. The default is 'Full' which sends information about the OS-Type, C! [. R6 D6 T- m2 h4 z F0 Z$ f # and compiled in modules.( E2 S9 ~& ]* H4 d% k# b' l5 l # Set to one of: Full | OS | Minor | Minimal | Major | Prod# h$ ~7 E5 A/ P/ s8 i # where Full conveys the most information, and Prod the least.# Q J1 Z2 h& g) Q3 p #. b3 N% D' ~7 L1 T, K0 n #ServerTokens Full & z. l! _, T4 XServerTokens Prod

#% N% G* T0 i; ]* D& K. N # Optionally add a line containing the server version and virtual host + g v, D L; Q! i% [# name to server-generated pages (internal error documents, FTP directory3 R6 @/ E6 g6 {# F% j # listings, mod_status and mod_info output etc., but not CGI generated; b! D2 u, ?; ?9 w: Y2 i # documents or custom error documents). 6 ]: f) C" I& F& o; H( n# Set to "EMail" to also include a mailt link to the ServerAdmin. ' Z' m+ L+ F$ r' S# Set to one of: On | Off | EMail , w' K8 H8 `9 J# * N1 ^5 b* C# [2 p q$ j$ U4 I: bServerSignature On. X! G0 D5 v9 }. [ ServerSignature Off

修改后重起apache，再看看， ( r [# w4 H9 P G( Qyiming# nc security.zz.ha.cn 80( {/ B% u! l+ @5 O% c* f7 i get index.lakdsjf' U, v7 j1 n" H- s <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">* k: Z5 v3 O; M( U <html><head> # J, k# d4 d- q; w& Y<title>400 Bad Request</title>/ N+ r3 ?* ]4 a0 [ </head><body>5 x& r1 B& }/ u0 k9 s% Z4 r# [ <h1>Bad Request</h1> / v) w* T$ D; H: W6 I<p>Your browser sent a request that this server could not understand.<br />1 r% G. u4 q: X/ k </p> - L4 I8 X' [' @; f* L</body></html>

6 _' c1 O% N% ^