Apache: how to hide server version and operation system from users?

Question

I've read on one site that I need to add two lines to httpd.conf file:

ServerSignature Off

ServerTokens Prod

But when I've added them nothing changed. As previously I can see in my browser

Apache/2.2.16 (Debian)

Maybe that's important: When I opened file (I mean before adding above lines) httpd.conf I saw it's empty. I use VPS.

Thanks!

score 45 · Answer 1 · edited Jan 25 '21 at 09:54

45

Simple:

sudo nano /etc/apache2/conf-enabled/security.conf

Then:

Restart Apache :

sudo service apache2 restart

This article may also help you: Hide Apache Information

edited Jan 25 '21 at 09:54

SharpC

answered Jul 07 '16 at 17:18

This worked perfectly to me. Wondering why isn't it the default on Apache. – Zaheer Baloch Jan 02 '21 at 00:54
1

Doesn't work on Windows :( Still shows "Server: Apache/2.4.43 (Win64)" – endo64 Dec 01 '21 at 23:57
did not work for me on ubuntu 20.04 – Admia Dec 21 '21 at 22:09

score 22 · Accepted Answer · answered Jan 25 '12 at 10:24

22

you didnt give enough information about os/distribution etc

but in ubuntu's apache installation apache2.conf looks like this:

<cut>
Include httpd.conf
Include ports.conf
Include conf.d/
Include sites-enabled/

and in conf.d/security you can see

ServerTokens OS

just check your configs, somewhere it gets overwritten after you set it in your httpd.conf

answered Jan 25 '12 at 10:24

jackdoe

Yes, I found they overriden in `security` file. When I've changed them there - apache version and OS information dissappered. Thanks! – Vitalii Ponomar Jan 25 '12 at 10:33
Can we hide the server name itself? i.e., `Apache` – shaik moeed Feb 13 '20 at 10:54

SharpC · Answer 3 · 2021-01-26T11:54:05.047

3

sudo apt-get install libapache2-mod-security2

Then add this to /etc/apache2/apache.conf (you can use any name, here I've used space):

<IfModule security2_module>
    SecRuleEngine on
    ServerTokens Min
    SecServerSignature " "
</IfModule>

and restart Apache:

sudo service apache2 restart

For a full write up incorporating the answer by @ShanuTThankachan see here.

edited Jan 26 '21 at 11:54

answered Jan 25 '21 at 11:11

SharpC

3 Answers3