|
作者：Yiming Gong9 s. R/ u0 _/ |) }0 P3 W9 S! S
http://security.zz.ha.cn
1 s# j5 {' Z+ f1 e- m默认情况下apache是会给client端回显版本号码的，可以测试如下,在client端使用nc联接起着apache的目的主机80端口，发送错误的get请求 " Q) e$ m- s/ D! I" q: v
yiming# nc security.zz.ha.cn 80
$ t- C/ h! F* [0 K# q* ~8 B! D- `get index.lakdsjf
* z/ b% X v& Y$ X/ R" @<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">$ L% T6 X/ Z4 l3 W' ?
<html><head>
1 |' j+ ~- V+ ~4 U, c9 ~<title>400 Bad Request</title>% V) s# U, t- I$ G- \, \( Q) G: z/ R0 _
</head><body>
: @! \9 o& T1 v) J<h1>Bad Request</h1>
" B% a. O5 u$ g& q* v<p>Your browser sent a request that this server could not understand.<br />( c2 W0 N( b5 s
</p>
! d* Z6 H+ ^: d& `5 U8 _<hr />
9 O! O& O; ~; p& R [<address>Apache/x.y.z Server at security.zz.ha.cn Port 80</address>
$ {" N: K. y- b( Z: \3 O* i8 s. z</body></html>
, N2 o; f$ J% I, s! T- p' g1 M! _, ^4 ` k1 Z. o
我们看到上面显示了apache的版本号（：） 俺隐去了真实版本），这可不太好，能修改一下么？
" g( K9 p" s1 r. ~3 v答案是肯定的！
! Y0 s" |, j) |, O4 o) }改动apache的配置文件，找到ServerTokens和ServerSignature两个directive,修改默认属性：- X2 `8 s8 x7 D- L1 W+ F; R: L
如下 q& b) ~- d+ ?+ L
# and compiled in modules.
& f5 E- y5 s4 m#: g, O# k4 D# G. k$ o" x
# ServerTokens
3 v1 A6 c9 J" L& k0 s# This directive configures what you return as the Server HTTP response1 g, s8 ?! M# [& F$ O; \
# Header. The default is 'Full' which sends information about the OS-Type
+ @2 r5 l# E0 @" Q$ M# D1 f5 |! Z# and compiled in modules.& _, ]$ {. {) H4 o
# Set to one of: Full | OS | Minor | Minimal | Major | Prod K+ z5 s+ W, R# f
# where Full conveys the most information, and Prod the least.
4 V' U% e q& r8 q+ h#
- W9 R+ N0 Y5 q3 C9 h- J0 p#ServerTokens Full
! l- i. _4 D1 v& U1 ]ServerTokens Prod
( B! d. f# I) e#
; C, n7 h4 T% ]1 i4 p. ^3 Z# Optionally add a line containing the server version and virtual host8 V D8 n/ k# b! p. W9 [+ z
# name to server-generated pages (internal error documents, FTP directory2 G6 ~4 `! d' u9 g% U; b
# listings, mod_status and mod_info output etc., but not CGI generated! D) j# g( A+ _: E4 v: J* O" k
# documents or custom error documents).
! p Z( J4 L3 R2 o+ Z# Set to "EMail" to also include a mailt link to the ServerAdmin.( b/ O z/ D( g8 l
# Set to one of: On | Off | EMail
; o: H# A2 Y% ?1 M u3 |#, y/ W3 o- R) G: Q/ [/ P! l% c
ServerSignature On
6 s' f L8 B, f9 JServerSignature Off , u G$ N/ w$ i! ]
修改后重起apache，再看看， # A e2 p" F" U& b) @
yiming# nc security.zz.ha.cn 800 S4 G; C0 M9 V
get index.lakdsjf8 q* t# G& t. `- p) a
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">/ }8 s+ n$ T6 n/ p% a
<html><head>
I( Y+ ~9 A6 Q2 @<title>400 Bad Request</title>
u( _! W, F/ S8 S</head><body>
' f O$ K$ ]7 v0 d<h1>Bad Request</h1>
! A S* y/ k) f9 }<p>Your browser sent a request that this server could not understand.<br />9 B# Y4 f( R l1 O
</p>
: n& ~" Q$ Q$ T6 j c- I</body></html>
7 s7 b0 u# B. t( N" _
' D; H/ P2 Z& c2 N/ y4 Z) s6 I/ A
| 
IP卡
狗仔卡
发表于 2004-10-5 18:21
转播
淘帖
分享
收藏
支持
反对
微信
提升卡
置顶卡
沉默卡
喧嚣卡
变色卡
抢沙发
显身卡
