QQ登录

只需要一步,快速开始

 注册地址  找回密码
查看: 6812|回复: 0
打印 上一主题 下一主题

如何叫你的apache不回显版本

[复制链接]
字体大小: 正常 放大
韩冰        

823

主题

3

听众

4048

积分

我的地盘我做主

该用户从未签到

发帖功臣 元老勋章

跳转到指定楼层
1#
发表于 2004-10-5 18:21 |只看该作者 |倒序浏览
|招呼Ta 关注Ta

作者:Yiming Gong9 s. R/ u0 _/ |) }0 P3 W9 S! S http://security.zz.ha.cn

1 s# j5 {' Z+ f1 e- m

默认情况下apache是会给client端回显版本号码的,可以测试如下,在client端使用nc联接起着apache的目的主机80端口,发送错误的get请求

" Q) e$ m- s/ D! I" q: v

yiming# nc security.zz.ha.cn 80 $ t- C/ h! F* [0 K# q* ~8 B! D- `get index.lakdsjf * z/ b% X v& Y$ X/ R" @<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">$ L% T6 X/ Z4 l3 W' ? <html><head> 1 |' j+ ~- V+ ~4 U, c9 ~<title>400 Bad Request</title>% V) s# U, t- I$ G- \, \( Q) G: z/ R0 _ </head><body> : @! \9 o& T1 v) J<h1>Bad Request</h1> " B% a. O5 u$ g& q* v<p>Your browser sent a request that this server could not understand.<br />( c2 W0 N( b5 s </p> ! d* Z6 H+ ^: d& `5 U8 _<hr /> 9 O! O& O; ~; p& R [<address>Apache/x.y.z Server at security.zz.ha.cn Port 80</address> $ {" N: K. y- b( Z: \3 O* i8 s. z</body></html>

, N2 o; f$ J% I, s! T

- p' g1 M! _, ^4 ` k1 Z. o 我们看到上面显示了apache的版本号(:) 俺隐去了真实版本),这可不太好,能修改一下么? " g( K9 p" s1 r. ~3 v答案是肯定的! ! Y0 s" |, j) |, O4 o) }改动apache的配置文件,找到ServerTokens和ServerSignature两个directive,修改默认属性:- X2 `8 s8 x7 D- L1 W+ F; R: L 如下

q& b) ~- d+ ?+ L

# and compiled in modules. & f5 E- y5 s4 m#: g, O# k4 D# G. k$ o" x # ServerTokens 3 v1 A6 c9 J" L& k0 s# This directive configures what you return as the Server HTTP response1 g, s8 ?! M# [& F$ O; \ # Header. The default is 'Full' which sends information about the OS-Type + @2 r5 l# E0 @" Q$ M# D1 f5 |! Z# and compiled in modules.& _, ]$ {. {) H4 o # Set to one of: Full | OS | Minor | Minimal | Major | Prod K+ z5 s+ W, R# f # where Full conveys the most information, and Prod the least. 4 V' U% e q& r8 q+ h# - W9 R+ N0 Y5 q3 C9 h- J0 p#ServerTokens Full ! l- i. _4 D1 v& U1 ]ServerTokens Prod

( B! d. f# I) e

# ; C, n7 h4 T% ]1 i4 p. ^3 Z# Optionally add a line containing the server version and virtual host8 V D8 n/ k# b! p. W9 [+ z # name to server-generated pages (internal error documents, FTP directory2 G6 ~4 `! d' u9 g% U; b # listings, mod_status and mod_info output etc., but not CGI generated! D) j# g( A+ _: E4 v: J* O" k # documents or custom error documents). ! p Z( J4 L3 R2 o+ Z# Set to "EMail" to also include a mailt link to the ServerAdmin.( b/ O z/ D( g8 l # Set to one of: On | Off | EMail ; o: H# A2 Y% ?1 M u3 |#, y/ W3 o- R) G: Q/ [/ P! l% c ServerSignature On 6 s' f L8 B, f9 JServerSignature Off

, u G$ N/ w$ i! ]

修改后重起apache,再看看, # A e2 p" F" U& b) @ yiming# nc security.zz.ha.cn 800 S4 G; C0 M9 V get index.lakdsjf8 q* t# G& t. `- p) a <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">/ }8 s+ n$ T6 n/ p% a <html><head> I( Y+ ~9 A6 Q2 @<title>400 Bad Request</title> u( _! W, F/ S8 S</head><body> ' f O$ K$ ]7 v0 d<h1>Bad Request</h1> ! A S* y/ k) f9 }<p>Your browser sent a request that this server could not understand.<br />9 B# Y4 f( R l1 O </p> : n& ~" Q$ Q$ T6 j c- I</body></html>

7 s7 b0 u# B. t( N" _

' D; H/ P2 Z& c2 N/ y4 Z) s6 I/ A

zan
转播转播0 分享淘帖0 分享分享0 收藏收藏0 支持支持0 反对反对0 微信微信
您需要登录后才可以回帖 登录 | 注册地址

qq
收缩
  • 电话咨询

  • 04714969085
fastpost

关于我们| 联系我们| 诚征英才| 对外合作| 产品服务| QQ

手机版|Archiver| |繁體中文 手机客户端  

蒙公网安备 15010502000194号

Powered by Discuz! X2.5   © 2001-2013 数学建模网-数学中国 ( 蒙ICP备14002410号-3 蒙BBS备-0002号 )     论坛法律顾问:王兆丰

GMT+8, 2026-8-26 03:10 , Processed in 0.437400 second(s), 52 queries .

回顶部