Disable fingerprint in Twisted Web

Question

I did a nmap to my server and i watch the fingerprint, how can i disable it?

443/tcp  open     ssl/http     TwistedWeb httpd 9.0.0

Answer 1

The "fingerprint" is how server identifies itself at the start of http session. Thus we should look at what implements Web server in twisted and where does it keep its identification.

Now if we look at http://twistedmatrix.com/trac/browser/tags/releases/twisted-12.2.0/twisted/web/server.py line 498 states

version = "TwistedWeb/%s" % copyright.version

This variable then gets handled by Request.process() method

class Request(pb.Copyable, http.Request, components.Componentized):
 ....
     def process(self):
        "Process a request."

        # get site from channel
        self.site = self.channel.site

        # set various default headers
        self.setHeader('server', version)
        self.setHeader('date', http.datetimeToString())

        # Resource Identification
        self.prepath = []
        self.postpath = map(unquote, string.split(self.path[1:], '/'))
        try:
            resrc = self.site.getResourceFor(self)
            self.render(resrc)
        except:
            self.processingFailed(failure.Failure())

So you could easily subclass Request and overwrite process method, to do what you like. Or you in theory could do something like this in your application code:

from twisted.web import server
server.version = "COBOL HTTPD SERVICE"

overriding version value in the imported resource.