QQ登录

只需要一步,快速开始

 注册地址  找回密码
查看: 6814|回复: 0
打印 上一主题 下一主题

如何叫你的apache不回显版本

[复制链接]
字体大小: 正常 放大
韩冰        

823

主题

3

听众

4048

积分

我的地盘我做主

该用户从未签到

发帖功臣 元老勋章

跳转到指定楼层
1#
发表于 2004-10-5 18:21 |只看该作者 |倒序浏览
|招呼Ta 关注Ta

作者:Yiming Gong 6 L: |8 G& x1 ^# v' o% Khttp://security.zz.ha.cn

6 S% V) F( Y& {0 |, @2 A4 N

默认情况下apache是会给client端回显版本号码的,可以测试如下,在client端使用nc联接起着apache的目的主机80端口,发送错误的get请求

& f* P* c/ o" z

yiming# nc security.zz.ha.cn 806 \3 ^) I% x Y8 ?. Z get index.lakdsjf & t( o& o2 ~; v1 ~) N6 F& {2 L0 I<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"># \( X2 J7 E. L& a <html><head>5 N, G$ ]- i' u8 }/ l <title>400 Bad Request</title> " b* X2 \" j7 x* `# G</head><body>8 ?5 l- Q7 e0 i/ H3 v @' m: J$ T( p% E <h1>Bad Request</h1> 4 ?; [7 c; \6 m1 x<p>Your browser sent a request that this server could not understand.<br />% M2 w+ w) t! _! | </p>/ A+ g2 U- d( g2 j <hr /> ! X1 m$ P+ h7 l<address>Apache/x.y.z Server at security.zz.ha.cn Port 80</address> & G) _% n; g+ A* i# X K6 h0 y</body></html>

3 |3 ?' z8 H4 P+ i- W, T, U) s2 n

6 d v: U' y& W: X. p 我们看到上面显示了apache的版本号(:) 俺隐去了真实版本),这可不太好,能修改一下么? + B% r! U W! X9 k/ Q答案是肯定的! ! f- B# G3 ]# _8 ]% i+ C/ z7 e改动apache的配置文件,找到ServerTokens和ServerSignature两个directive,修改默认属性: / D+ Z' W5 X- ? c3 S0 ]如下

1 u/ \8 ~- h3 N, b# Q) W) I

# and compiled in modules. p Q& U* G" _8 R0 |0 e#8 A/ @) R: N# G& N # ServerTokens) l, J2 a5 R8 Q1 ~1 m: ]5 K& P # This directive configures what you return as the Server HTTP response8 @! |! G% i9 B4 [ # Header. The default is 'Full' which sends information about the OS-Type+ ?- D* i$ W0 P, R( G. P # and compiled in modules. 5 P# s0 r" M6 ]$ F# Set to one of: Full | OS | Minor | Minimal | Major | Prod - q. j9 A9 ~# @: Y: _# where Full conveys the most information, and Prod the least.* E0 y# F$ {. S( Q0 c W # 1 g6 c( E3 |/ ]: E1 i+ A1 j/ U#ServerTokens Full 7 `2 z, z' B3 b: B) C, v9 {' @ServerTokens Prod

9 a2 p# K+ n% H ]6 g4 p* M

## V& O, f; ^, u1 U* y # Optionally add a line containing the server version and virtual host * Y" r" q% Q! T, m( \# M1 |+ @6 O# name to server-generated pages (internal error documents, FTP directory . V; T7 ?* i6 |6 y4 T. V! b# listings, mod_status and mod_info output etc., but not CGI generated4 e9 `& o& ]3 m5 ?1 b # documents or custom error documents). 7 T. b2 @* _* w Y1 i7 n5 B# Set to "EMail" to also include a mailt link to the ServerAdmin. $ L$ A) z3 B: U7 K7 V# Set to one of: On | Off | EMail # X n' e: I& E! v/ ~# s5 V#$ F/ }3 n! C, X. j0 m$ ?+ ^ ServerSignature On 5 g( u- l- |' Z" e6 B; T0 SServerSignature Off

3 O% `0 P- d: L, K# v" j" ]

修改后重起apache,再看看, * a7 i# X! c. F H) E! S$ c% Uyiming# nc security.zz.ha.cn 80# u. E$ _6 I8 X X/ i! L get index.lakdsjf 9 m1 n; I! Z+ N0 u& N) q' L7 h5 Z0 K<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">+ ^9 R1 x0 H" G; \* E0 C7 A( \ <html><head>' i/ ^3 U: t) b <title>400 Bad Request</title>% i9 J, m- N) l3 F5 J/ f$ l </head><body>$ o# H6 Q+ c7 p <h1>Bad Request</h1> . p- L3 s+ j' B<p>Your browser sent a request that this server could not understand.<br /> 6 Y' y% _2 E$ t3 B</p> & z4 A- M! a- G" |</body></html>

# u: C! ^+ ]: w

- P" P4 ^1 K T

zan
转播转播0 分享淘帖0 分享分享0 收藏收藏0 支持支持0 反对反对0 微信微信
您需要登录后才可以回帖 登录 | 注册地址

qq
收缩
  • 电话咨询

  • 04714969085
fastpost

关于我们| 联系我们| 诚征英才| 对外合作| 产品服务| QQ

手机版|Archiver| |繁體中文 手机客户端  

蒙公网安备 15010502000194号

Powered by Discuz! X2.5   © 2001-2013 数学建模网-数学中国 ( 蒙ICP备14002410号-3 蒙BBS备-0002号 )     论坛法律顾问:王兆丰

GMT+8, 2026-8-26 14:22 , Processed in 0.422337 second(s), 52 queries .

回顶部