查看: 6815|回复: 0

如何叫你的apache不回显版本

字体大小: 正常放大

韩冰

823 主题	3 听众	4048 积分

我的地盘我做主

该用户从未签到

电梯直达

1^#

发表于 2004-10-5 18:21 |只看该作者 |倒序浏览

|招呼Ta 关注Ta

作者：Yiming Gong , T6 e1 |2 y" D8 _# ]* ^+ H, A8 F' whttp://security.zz.ha.cn

默认情况下apache是会给client端回显版本号码的，可以测试如下,在client端使用nc联接起着apache的目的主机80端口，发送错误的get请求

yiming# nc security.zz.ha.cn 80 9 W6 O" u3 E! W* @+ Cget index.lakdsjf $ A9 z. ?5 m) Q+ k- `<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">/ u9 m4 U9 v4 ^8 f) U2 k6 z <html><head> ( z) k( G9 V, c& i, q! S<title>400 Bad Request</title> : J8 M' _0 I7 B* a9 p, u</head><body>2 r% F+ r G6 P$ \ <h1>Bad Request</h1> M' M( j$ ^: I7 a8 m! e<p>Your browser sent a request that this server could not understand.<br /> ; Q2 m" |# l( O* D</p>3 X" |2 n4 j( {* j <hr />! [8 d$ ]% F7 q$ ]% P: ?3 s <address>Apache/x.y.z Server at security.zz.ha.cn Port 80</address> : a+ h' |; [, W, m+ q2 N+ S</body></html>

2 G8 Q5 n2 P3 z7 H% p 我们看到上面显示了apache的版本号（：）俺隐去了真实版本），这可不太好，能修改一下么？ # F: V) d9 ]7 \" z3 f答案是肯定的！8 ]; x6 i( q3 Z, ?+ d/ q& ?* u 改动apache的配置文件，找到ServerTokens和ServerSignature两个directive,修改默认属性： + g8 I. @3 {4 ~如下

# and compiled in modules.1 L# i) k! Y, `( {/ r k #! R' g2 ^1 c- l+ M7 D% D # ServerTokens; ~5 _2 x6 Q1 J: v # This directive configures what you return as the Server HTTP response$ ]/ I8 v4 h2 F9 h \! i$ |$ N # Header. The default is 'Full' which sends information about the OS-Type% s$ s9 R" @+ X6 s$ q" L # and compiled in modules. 8 R4 h2 c! _$ u t# Set to one of: Full | OS | Minor | Minimal | Major | Prod & @/ E; K" K o% J* O# where Full conveys the most information, and Prod the least.& A) j% I, a- [' ` # 2 N9 f' S# b- i. W* R#ServerTokens Full3 P$ S4 s- G2 B6 |: `+ ^ ServerTokens Prod

# / p2 L4 d3 N8 i* ^+ T1 ?0 x# Optionally add a line containing the server version and virtual host9 h; y2 i; S- [ e, [) @ # name to server-generated pages (internal error documents, FTP directory " V8 F* |, X) `) ~8 `" W6 M# listings, mod_status and mod_info output etc., but not CGI generated8 |* @* G7 s/ u/ n # documents or custom error documents). $ @' h3 [, G, D3 M# Set to "EMail" to also include a mailt link to the ServerAdmin. - L3 G* I, h0 Q4 r# Set to one of: On | Off | EMail 2 _) e6 Z/ F- X# \# L/ j$ p4 Q7 W" z#0 B. f' B& J+ I5 b5 w% f! r/ U ServerSignature On $ B+ c. t- b) `& vServerSignature Off

修改后重起apache，再看看， ( V0 x& |4 x/ p) iyiming# nc security.zz.ha.cn 80 ! T. Q+ ?* H# L; I1 p! H6 ?( c1 eget index.lakdsjf ) Y) A1 ~0 A2 c( r/ t<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">0 W& q4 P( E" k9 @ <html><head>' H8 y4 g3 A' W( t! A <title>400 Bad Request</title>/ _( h: e) w8 D </head><body># M% O% _- H: t- f4 I) c7 P2 V <h1>Bad Request</h1>) T; p# d* W: _7 W* o( n <p>Your browser sent a request that this server could not understand.<br /> 0 t( U3 }% L' E y</p>9 o$ |% m- G |3 Y6 e: o </body></html>

7 X% Z& W% f0 O5 B