查看: 6813|回复: 0

如何叫你的apache不回显版本

字体大小: 正常放大

韩冰

823 主题	3 听众	4048 积分

我的地盘我做主

该用户从未签到

电梯直达

1^#

发表于 2004-10-5 18:21 |只看该作者 |倒序浏览

|招呼Ta 关注Ta

作者：Yiming Gong7 H& }" H, p* }' g9 j9 v, b http://security.zz.ha.cn

默认情况下apache是会给client端回显版本号码的，可以测试如下,在client端使用nc联接起着apache的目的主机80端口，发送错误的get请求

yiming# nc security.zz.ha.cn 80 . w3 C- T. E! Uget index.lakdsjf 7 @1 @! f9 g- ^1 S<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"># u' P( g: x( ?4 F7 N <html><head> 0 G2 R2 J4 j9 x8 F& `8 y<title>400 Bad Request</title>& O: c- U4 m. h </head><body> 5 A" L; z! c4 l4 j9 f6 W1 g<h1>Bad Request</h1> 0 K4 F4 H$ Z. q<p>Your browser sent a request that this server could not understand.<br />9 [0 C! ~# k) e: @/ M3 T; o </p>& U: {- M9 m2 u <hr />* W0 g& i( c4 a <address>Apache/x.y.z Server at security.zz.ha.cn Port 80</address> 9 _4 x% u0 H+ i# K7 _: f f* S</body></html>

* b/ K C X! c& j$ f我们看到上面显示了apache的版本号（：）俺隐去了真实版本），这可不太好，能修改一下么？' g* s9 n: x5 }7 @2 j 答案是肯定的！- h9 o7 o; I9 o7 [' C/ i 改动apache的配置文件，找到ServerTokens和ServerSignature两个directive,修改默认属性： : \1 a, G3 K: w1 i' _如下

# and compiled in modules.2 _- i3 ~- S( |& B1 i" i- p7 C #0 [$ @! y% ?. C/ n1 m- q4 ] # ServerTokens 4 B+ } |& G/ N( `; M& j# This directive configures what you return as the Server HTTP response 1 g' e6 z- y' N9 }4 l' G3 I! C# Header. The default is 'Full' which sends information about the OS-Type: P5 G# h" r9 K* x/ L! k; N) R # and compiled in modules. * N# r) e* @% M0 H c, L' s1 Z$ C# Set to one of: Full | OS | Minor | Minimal | Major | Prod `* T# ?0 c/ d2 U: w2 ~: D7 i # where Full conveys the most information, and Prod the least. f% V6 [2 @, i" s! o #; [2 {" ?$ o+ A2 k/ N" v, P& H/ s# N- n6 ? #ServerTokens Full6 Y$ I; p, H% R% O, {4 q* y% g7 ` ServerTokens Prod

# + y1 a+ N% z7 D( i X# Optionally add a line containing the server version and virtual host) E+ H. X* ]& A # name to server-generated pages (internal error documents, FTP directory : Z' v" i/ W6 `( I8 L. y9 S# listings, mod_status and mod_info output etc., but not CGI generated $ v4 p S M }6 J4 L( J# documents or custom error documents). & t; ~! g& t, k: Y# _# Set to "EMail" to also include a mailt link to the ServerAdmin.0 G. l2 x# ], Q: B J # Set to one of: On | Off | EMail4 M( O6 x, k0 }% P9 t # 5 ~2 a% l5 ?+ L4 NServerSignature On8 @5 [/ S! u. i ServerSignature Off

修改后重起apache，再看看， " H4 {3 w: o# a5 ~& N- j" y F) iyiming# nc security.zz.ha.cn 80. q6 l+ A- ?, ~ get index.lakdsjf1 [' A: v; c8 p P2 Z <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> % _' \6 e1 a7 S# N3 i' Q<html><head> ; M. v' P, ~9 l( D% Y# S<title>400 Bad Request</title> 8 m" H& m3 `/ ^- V</head><body>& Q/ m( ]! B; u% i: {; g% x/ J <h1>Bad Request</h1>% }* \ x' H* F2 H8 E- W <p>Your browser sent a request that this server could not understand.<br />- u4 K; w+ q$ y# m# g </p> # c5 e* [8 Y+ N) Z</body></html>

h0 j& A: [, Q7 Y+ k( g J