Hiding Apache and PHP Server Signature Rumi, March 20, 2017March 26, 2017 Revealing web server signature with server/PHP version info can be a security risk as you are essentially telling attackers known vulnerabilities of your system. Thus it is recommended you disable all web server signatures as part of server hardening process. Disable Apache Web Server Signature Disabling Apache web server signature can be achieved by editing Apache config file. On Debian, Ubuntu or Linux Mint: $ sudo vi /etc/apache2/apache2.conf On CentOS, Fedora, RHEL or Arch Linux: $ sudo vi /etc/httpd/conf/httpd.conf Add the following two lines at the end of Apache config file. ServerSignature Off ServerTokens Prod Then restart web server to activate the change: $ sudo service apache2 restart (Debian, Ubuntu or Linux Mint) $ sudo service httpd restart (CentOS/RHEL 6) $ sudo systemctl restart httpd.service (Fedora, CentOS/RHEL 7, Arch Linux) The first line ‘ServerSignature Off’ makes Apache2 web server hide Apache version info on any error pages. However, without the second line ‘ServerTokens Prod’, Apache server will still include a detailed server token in HTTP response headers, which reveals Apache version number. What the second line ‘ServerTokens Prod’ does is to suppress a server token in HTTP response headers to a bare minimal. So with both lines in place, Apache will not reveal Apache version info in either web pages or HTTP response headers. Hide PHP Version Another potential security threat is PHP version info leak in HTTP response headers. By default, Apache web server includes PHP version info via “X-Powered-By” field in HTTP response headers. If you want to hide PHP version in HTTP headers, open php.ini file with a text editor, look for “expose_php = On”, and change it to "expose_php = Off" On Debian, Ubuntu, or Linux Mint: $ sudo vi /etc/php5/apache2/php.ini On CentOS, Fedora, RHEL or Arch Linux: $ sudo vi /etc/php.ini expose_php = Off Finally, restart Apache2 web server to reload updated PHP config file. Now you will no longer see “X-Powered-By” field in HTTP response headers. Src: http://ask.xmodulo.com/turn-off-server-signature-apache-web-server.html Related Administrations Apachephp
Administrations Install gnome via tasksel on Debain 12 March 3, 2024 Tasksel is already installed on Debian 12, so you don’t need to install it. However, if for some reason tasksel is not installed on your system, you can install it via the command below sudo apt install tasksel To install Gnome via tasksel, you need first to run tasksel sudo… Read More
PowerDNS Cache dump in CSV September 17, 2011 The objective is simple, a periodic cron cache dump of powerdns recursor on a setup. 1. create a shell code as below using nano- #nano /usr/local/bin/pdns-cache-dump.sh #!/bin/sh DAY=`/bin/date +%Y%m%d` TFILE="/var/log/pdns-cache/$(basename $0).$DAY.csv" rec_control dump-cache $TFILE echo "cache dump completed, dump script by rumi (hasan.emdad@mango.com.bd)" Related Read More
Install Jitsi Meet and configure load balancing July 14, 2020 Jitsi Meet is an open-source (Apache) WebRTC JavaScript application that uses Jitsi Videobridge to provide high quality, secure and scalable video conferences. It can be used as a replacement for proprietary services like Zoom, Whereby, Teams, Skype and many others. Requirements At least two Linux systems with Debian 10 DNS… Read More