Bug 10038 - decrease version reporting verbosity
: decrease version reporting verbosity
Status: CLOSED FIXED
: Sisyphus
(All bugs in Sisyphus/apache)
: unstable
: all Linux
: P2 enhancement
Assigned To:
:
: http://www.onlamp.com/pub/a/apache/20...
:
:
:
  Show dependency tree
 
Reported: 2006-09-25 19:46 by
Modified: 2006-12-17 23:28 (History)


Attachments


Note

You need to log in before you can comment on or make changes to this bug.


Description From 2006-09-25 19:46:08
Есть предложение добавить:
ServerSignature Off
ServerTokens ProductOnly

в конфиг по-умолчанию в порядке общей паранойи по "степени защищенности" системы.
------- Comment #1 From 2006-09-25 20:00:19 -------
(In reply to comment #0)
> Есть предложение добавить:
> ServerSignature Off
> ServerTokens ProductOnly
> 
> в конфиг по-умолчанию в порядке общей паранойи по "степени защищенности" системы.

Поддерживаю. Нефиг светить что стоит на машине.
------- Comment #2 From 2006-09-26 10:16:10 -------
Озабоченным также рекомендуется mod_security. (у меня работает :)
Ну и expose_php = Off в php.ini, if any.

Добавлено в первую секцию httpd.conf:

#
# ServerSignature: this allows the configuration of a trailing footer line
# under server-generated documents (error messages, mod_proxy ftp directory
# listings, mod_info output, ...).
#
# ServerTokens: controls whether Server response header field which is sent
# back to clients includes a description of the generic OS-type of the server
# as well as information about compiled-in modules.
#
# In ALT Linux, we came to conclusion that more verbosity by default is not
# what we want.  So we lock down this "information disclosure", but if you
# need it for debug, identification or anything else, feel free to comment
# these out.
ServerSignature Off
ServerTokens ProductOnly