2

I'm running Mod_Security and I'm using the SecServerSignature to customize the Server header that Apache returns. This part works fine, however I'm also running mod_fcgid which appends "mod_fcgid/2.3.5" to the header.

Is there any way I can turn this off? Setting ServerSignature off doesn't do anything. I was able to get it to go away by changing the ServerTokens but that removed the customization I had added.

matthew
  • 1,319
  • 1
  • 11
  • 21

3 Answers3

1

Use ServerTokens in a config file.

ServerTokens

This directive configures what you return as the Server HTTP response Header. The default is 'Full' which sends information about the OS-Type and compiled in modules.

Set to one of: Full | OS | Minor | Minimal | Major | Prod where Full conveys the most information, and Prod the least.

I suggest to set it to Prod, then they will only see that you are using Apache Server at domain.com Port 80.

Don't forget to restart/reload the Apache config files!

https://httpd.apache.org/docs/2.2/mod/core.html#servertokens

Alex
  • 346
  • 1
  • 8
0

ServerTokens is what manipulates the Server response header. (ServerSignature is used for server generated documents.)

However, if you want to completely control the Server header I would suggest using the Header option:

Header set Server "Apache/2 my_customizations"

as an example.

rjk
  • 330
  • 1
  • 3
  • 9
  • hmmm... That doesn't seem to work. I don't think Apache allows you to override the server header that way. – matthew Nov 02 '10 at 17:32
0

You may need to reorder the module loading in Apache so mod_security loads after mod_fcgi.

Read the "Server identity masking" section of the mod_security docs.
http://www.modsecurity.org/documentation/modsecurity-apache/1.9.3/html-multipage/06-special_features.html

Two notes: Mod_security will show the real server signature in the error_log which will be different than the one given to the public.

Second, the document also explains that SecServerSignature directive only works with ServerTokens set to "Full"

Mark

mfarver
  • 2,576
  • 14
  • 16
  • I've tried loading the module first and last, and it doesn't make a difference. I also doubled checked and ServerTokens are set to "Full" and the problem is in the actual response header not just the logs. Thanks – matthew Nov 17 '10 at 16:59
  • I'm not a great coder, but I did not see anything in the most recent version of mod_fcgi that would place an entry in the server description. What version are you running? – mfarver Nov 18 '10 at 18:23