查看: 6811|回复: 0

如何叫你的apache不回显版本

字体大小: 正常放大

韩冰

823 主题	3 听众	4048 积分

我的地盘我做主

该用户从未签到

电梯直达

1^#

发表于 2004-10-5 18:21 |只看该作者 |倒序浏览

|招呼Ta 关注Ta

作者：Yiming Gong ! b! T4 I% @3 N/ Y9 G: T/ t+ mhttp://security.zz.ha.cn

默认情况下apache是会给client端回显版本号码的，可以测试如下,在client端使用nc联接起着apache的目的主机80端口，发送错误的get请求

yiming# nc security.zz.ha.cn 80, z0 t8 [ s0 n5 [: U* [7 k get index.lakdsjf, m( `, \2 R8 i. B/ ~+ d3 J <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> 2 G7 r- b$ W% h+ o, D0 A0 F. d4 Z( u<html><head>" ~3 g; y1 w0 ?, g8 I- _ <title>400 Bad Request</title>2 o D5 p I) D2 D+ B+ P </head><body>3 [: b0 b( {. s$ e2 [( _+ T- e <h1>Bad Request</h1> ) n f" I9 m/ ?/ d<p>Your browser sent a request that this server could not understand.<br /> % `- R5 P2 Z) Q6 ?</p>! V! ~% I- M; |( P. l. f# _ <hr />$ I8 }/ \% ~. \ F <address>Apache/x.y.z Server at security.zz.ha.cn Port 80</address> 0 _9 |% X$ _0 ^; h% C4 |</body></html>

0 p& ]! f9 ^7 b- U4 k我们看到上面显示了apache的版本号（：）俺隐去了真实版本），这可不太好，能修改一下么？5 ?: E; J- j b$ E! ~ 答案是肯定的！. N* g% o* _0 y+ x: F1 ] 改动apache的配置文件，找到ServerTokens和ServerSignature两个directive,修改默认属性： 5 @+ h& Y3 V- Q) z* H如下

# and compiled in modules. 2 r( L, ~) r; E# l7 q: V S( y# , X" w. A: o% S, g* |, Z# ServerTokens & v: _7 L0 B) a* B; P; E* L# This directive configures what you return as the Server HTTP response1 k( ^: p9 }2 s" e # Header. The default is 'Full' which sends information about the OS-Type % V) K% p6 X. r) J4 F+ n5 B# and compiled in modules. - n6 E) m) _3 |% g( B# Set to one of: Full | OS | Minor | Minimal | Major | Prod 0 N i; a# ^- d, G5 \# where Full conveys the most information, and Prod the least.! J' a4 g/ k4 A* M7 U7 {2 k1 I #, B: G: f. }# `8 [( Y* v' O #ServerTokens Full# c% v' p. l6 e( L% H ServerTokens Prod

#( B/ `. P6 L; U, i: E. ^; m # Optionally add a line containing the server version and virtual host / Y3 d T, P* P2 l/ A M8 T Z/ s# name to server-generated pages (internal error documents, FTP directory 4 X2 s7 L. }! D. m& M. U5 \8 l# listings, mod_status and mod_info output etc., but not CGI generated, H5 \0 J Q3 ~: Y/ R' o # documents or custom error documents). ; s( j8 o+ ~/ r, _: S" W! b! w, L2 ?# Set to "EMail" to also include a mailt link to the ServerAdmin. 7 W2 Z n2 n/ z4 b. K# Set to one of: On | Off | EMail ' u+ t# u7 m- q# : [- J: k" d1 R! {ServerSignature On : M/ k$ O- l7 _+ F) F) MServerSignature Off

修改后重起apache，再看看， ) ^0 [) S0 J+ s* O1 T2 eyiming# nc security.zz.ha.cn 80 / ?7 x5 Z9 j/ o( K- q/ X, Yget index.lakdsjf # n- o3 ?" M2 _# E' p# h% s<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> 8 U v, z4 m* G* ?! q) Q<html><head>3 Y* n6 i2 Q* d d <title>400 Bad Request</title>8 p1 W* I; l7 }0 i7 d' I </head><body>* J5 e, u& ]- c- S4 s <h1>Bad Request</h1> & h5 f7 b' O5 p! v+ |$ O$ p: q<p>Your browser sent a request that this server could not understand.<br />! s( ~8 |! Y1 C, q( y </p># |0 X& u2 Z2 z. ?- z </body></html>

- E1 E% f3 V4 Z( M/ Q% l% k