Bug 10038 - decrease version reporting verbosity
Summary: decrease version reporting verbosity
Status: CLOSED FIXED
Alias: None
Product: Sisyphus
Classification: Development
Component: apache (show other bugs)
Version: unstable
Hardware: all Linux
: P2 enhancement
Assignee: Michael Shigorin
QA Contact: qa-sisyphus
URL: http://www.onlamp.com/pub/a/apache/20...
Keywords:
Depends on:
Blocks:
 
Reported: 2006-09-25 19:46 MSD by Konstantin Pavlov
Modified: 2006-12-17 23:28 MSK (History)
15 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Konstantin Pavlov 2006-09-25 19:46:08 MSD 
Есть предложение добавить:
ServerSignature Off
ServerTokens ProductOnly

в конфиг по-умолчанию в порядке общей паранойи по "степени защищенности" системы.
Comment 1 Igor Zubkov 2006-09-25 20:00:19 MSD 
(In reply to comment #0)
> Есть предложение добавить:
> ServerSignature Off
> ServerTokens ProductOnly
> 
> в конфиг по-умолчанию в порядке общей паранойи по "степени защищенности" системы.

Поддерживаю. Нефиг светить что стоит на машине.
Comment 2 Michael Shigorin 2006-09-26 10:16:10 MSD 
Озабоченным также рекомендуется mod_security. (у меня работает :)
Ну и expose_php = Off в php.ini, if any.

Добавлено в первую секцию httpd.conf:

#
# ServerSignature: this allows the configuration of a trailing footer line
# under server-generated documents (error messages, mod_proxy ftp directory
# listings, mod_info output, ...).
#
# ServerTokens: controls whether Server response header field which is sent
# back to clients includes a description of the generic OS-type of the server
# as well as information about compiled-in modules.
#
# In ALT Linux, we came to conclusion that more verbosity by default is not
# what we want.  So we lock down this "information disclosure", but if you
# need it for debug, identification or anything else, feel free to comment
# these out.
ServerSignature Off
ServerTokens ProductOnly