|
作者：Yiming Gong
6 L: |8 G& x1 ^# v' o% Khttp://security.zz.ha.cn
6 S% V) F( Y& {0 |, @2 A4 N默认情况下apache是会给client端回显版本号码的，可以测试如下,在client端使用nc联接起着apache的目的主机80端口，发送错误的get请求
& f* P* c/ o" zyiming# nc security.zz.ha.cn 806 \3 ^) I% x Y8 ?. Z
get index.lakdsjf
& t( o& o2 ~; v1 ~) N6 F& {2 L0 I<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"># \( X2 J7 E. L& a
<html><head>5 N, G$ ]- i' u8 }/ l
<title>400 Bad Request</title>
" b* X2 \" j7 x* `# G</head><body>8 ?5 l- Q7 e0 i/ H3 v @' m: J$ T( p% E
<h1>Bad Request</h1>
4 ?; [7 c; \6 m1 x<p>Your browser sent a request that this server could not understand.<br />% M2 w+ w) t! _! |
</p>/ A+ g2 U- d( g2 j
<hr />
! X1 m$ P+ h7 l<address>Apache/x.y.z Server at security.zz.ha.cn Port 80</address>
& G) _% n; g+ A* i# X K6 h0 y</body></html> 3 |3 ?' z8 H4 P+ i- W, T, U) s2 n
6 d v: U' y& W: X. p
我们看到上面显示了apache的版本号（：） 俺隐去了真实版本），这可不太好，能修改一下么？
+ B% r! U W! X9 k/ Q答案是肯定的！
! f- B# G3 ]# _8 ]% i+ C/ z7 e改动apache的配置文件，找到ServerTokens和ServerSignature两个directive,修改默认属性：
/ D+ Z' W5 X- ? c3 S0 ]如下 1 u/ \8 ~- h3 N, b# Q) W) I
# and compiled in modules.
p Q& U* G" _8 R0 |0 e#8 A/ @) R: N# G& N
# ServerTokens) l, J2 a5 R8 Q1 ~1 m: ]5 K& P
# This directive configures what you return as the Server HTTP response8 @! |! G% i9 B4 [
# Header. The default is 'Full' which sends information about the OS-Type+ ?- D* i$ W0 P, R( G. P
# and compiled in modules.
5 P# s0 r" M6 ]$ F# Set to one of: Full | OS | Minor | Minimal | Major | Prod
- q. j9 A9 ~# @: Y: _# where Full conveys the most information, and Prod the least.* E0 y# F$ {. S( Q0 c W
#
1 g6 c( E3 |/ ]: E1 i+ A1 j/ U#ServerTokens Full
7 `2 z, z' B3 b: B) C, v9 {' @ServerTokens Prod 9 a2 p# K+ n% H ]6 g4 p* M
## V& O, f; ^, u1 U* y
# Optionally add a line containing the server version and virtual host
* Y" r" q% Q! T, m( \# M1 |+ @6 O# name to server-generated pages (internal error documents, FTP directory
. V; T7 ?* i6 |6 y4 T. V! b# listings, mod_status and mod_info output etc., but not CGI generated4 e9 `& o& ]3 m5 ?1 b
# documents or custom error documents).
7 T. b2 @* _* w Y1 i7 n5 B# Set to "EMail" to also include a mailt link to the ServerAdmin.
$ L$ A) z3 B: U7 K7 V# Set to one of: On | Off | EMail
# X n' e: I& E! v/ ~# s5 V#$ F/ }3 n! C, X. j0 m$ ?+ ^
ServerSignature On
5 g( u- l- |' Z" e6 B; T0 SServerSignature Off 3 O% `0 P- d: L, K# v" j" ]
修改后重起apache，再看看，
* a7 i# X! c. F H) E! S$ c% Uyiming# nc security.zz.ha.cn 80# u. E$ _6 I8 X X/ i! L
get index.lakdsjf
9 m1 n; I! Z+ N0 u& N) q' L7 h5 Z0 K<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">+ ^9 R1 x0 H" G; \* E0 C7 A( \
<html><head>' i/ ^3 U: t) b
<title>400 Bad Request</title>% i9 J, m- N) l3 F5 J/ f$ l
</head><body>$ o# H6 Q+ c7 p
<h1>Bad Request</h1>
. p- L3 s+ j' B<p>Your browser sent a request that this server could not understand.<br />
6 Y' y% _2 E$ t3 B</p>
& z4 A- M! a- G" |</body></html>
# u: C! ^+ ]: w
- P" P4 ^1 K T
| 
IP卡
狗仔卡
发表于 2004-10-5 18:21
转播
淘帖
分享
收藏
支持
反对
微信
提升卡
置顶卡
沉默卡
喧嚣卡
变色卡
抢沙发
显身卡
