|
作者：Yiming Gong/ Q0 X* n @; y% B: B
http://security.zz.ha.cn
- e5 v# ?9 P, K默认情况下apache是会给client端回显版本号码的，可以测试如下,在client端使用nc联接起着apache的目的主机80端口，发送错误的get请求
* \. z F/ @9 w& O4 D* i0 Gyiming# nc security.zz.ha.cn 80
0 M* D: u' i3 X& q3 bget index.lakdsjf7 h' o# C7 U# w4 ?1 J
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
0 Q" g8 u- v! q) e K<html><head>& o" `% K, D" a1 S
<title>400 Bad Request</title>
" W( I0 G K9 ~</head><body>7 ^( A) h2 m3 G
<h1>Bad Request</h1>
/ W/ B+ L, Z; A; l6 `+ S" W9 E/ b" p<p>Your browser sent a request that this server could not understand.<br />& w" ?4 w' @: @) K/ x/ I
</p>9 v' E L ]. O% c
<hr />. A/ t- e w) d2 [7 M6 @
<address>Apache/x.y.z Server at security.zz.ha.cn Port 80</address>) ~, f/ w5 N S4 V
</body></html>
( |+ ~3 t4 O& N1 G. ]8 |) C% @8 `
9 a4 B. ]/ ^ S( k我们看到上面显示了apache的版本号（：） 俺隐去了真实版本），这可不太好，能修改一下么？
! ^; |# i+ R6 V4 x答案是肯定的！
& s# U! y7 v7 ]8 J改动apache的配置文件，找到ServerTokens和ServerSignature两个directive,修改默认属性：
- X# @4 ]2 {) }8 n. C/ v如下 - S, U$ Q: s: S8 M3 |
# and compiled in modules.
9 ~5 Y# P Q7 g, u: E#
9 r i O0 Q6 l: W+ o: X# ServerTokens* g3 O! F6 ^8 k# s" V
# This directive configures what you return as the Server HTTP response/ ~& w& [& l; Y1 ]1 y, u( y( X
# Header. The default is 'Full' which sends information about the OS-Type, i/ Z; z d, } x( c
# and compiled in modules.
0 w6 O$ [4 Y2 U5 V6 C2 t* C# Set to one of: Full | OS | Minor | Minimal | Major | Prod( N2 L& y! s3 J9 l% B0 n; J9 F
# where Full conveys the most information, and Prod the least.
! { O5 \0 _, P3 e+ f" A" Z; Y#8 z& [1 g) e0 X9 k* M: I
#ServerTokens Full
- k5 f3 a5 q9 F- j) f3 {ServerTokens Prod 9 W$ l3 w/ [9 U/ N- v: ?
#
) r% ^- r! N9 X% r) G; s3 o$ }# Optionally add a line containing the server version and virtual host
4 l; {; v5 X/ ]% T5 q# name to server-generated pages (internal error documents, FTP directory
/ y- S' z7 ~" t3 {" F* F# listings, mod_status and mod_info output etc., but not CGI generated: N: d1 z: M' \: q( l# \
# documents or custom error documents)." X+ k, F# B9 g I' b
# Set to "EMail" to also include a mailt link to the ServerAdmin.
% X! {$ [: E ^" G- ]# Set to one of: On | Off | EMail
3 ~& `0 M: N. ]( z& s7 P# ^* ]) N0 D7 W' [6 w+ q
ServerSignature On6 M) t% P ?! N$ w1 W7 b' }# X
ServerSignature Off
9 o& c- Z1 E, r/ c5 M修改后重起apache，再看看，
% [) [ j% \ Y/ f6 {yiming# nc security.zz.ha.cn 800 u/ n: ^7 S. Q0 v- q4 l
get index.lakdsjf+ T/ f! v4 g- K# n" v) I. D
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
& H: S3 d5 e H# } k<html><head>
" u+ g/ j. X6 j1 F7 M# n<title>400 Bad Request</title>
% [% E" O) W7 H. f, g: @, I</head><body>
0 m' E9 H/ }+ |% u8 W, L' D<h1>Bad Request</h1>
' ?- V) a2 D7 e5 w4 e<p>Your browser sent a request that this server could not understand.<br />, W, ?: j* o# `3 W! `
</p>6 m: N& \9 B6 \' y# d5 o6 u
</body></html> ; [" N0 F6 V- n' z3 R9 \. e1 L& i
2 v- s7 d$ J2 `# S d0 g
| 
IP卡
狗仔卡
发表于 2004-10-5 18:21
转播
淘帖
分享
收藏
支持
反对
微信
提升卡
置顶卡
沉默卡
喧嚣卡
变色卡
抢沙发
显身卡
