Hiding Apache and PHP Server Signature Rumi, March 20, 2017March 26, 2017 Revealing web server signature with server/PHP version info can be a security risk as you are essentially telling attackers known vulnerabilities of your system. Thus it is recommended you disable all web server signatures as part of server hardening process. Disable Apache Web Server Signature Disabling Apache web server signature can be achieved by editing Apache config file. On Debian, Ubuntu or Linux Mint: $ sudo vi /etc/apache2/apache2.conf On CentOS, Fedora, RHEL or Arch Linux: $ sudo vi /etc/httpd/conf/httpd.conf Add the following two lines at the end of Apache config file. ServerSignature Off ServerTokens Prod Then restart web server to activate the change: $ sudo service apache2 restart (Debian, Ubuntu or Linux Mint) $ sudo service httpd restart (CentOS/RHEL 6) $ sudo systemctl restart httpd.service (Fedora, CentOS/RHEL 7, Arch Linux) The first line ‘ServerSignature Off’ makes Apache2 web server hide Apache version info on any error pages. However, without the second line ‘ServerTokens Prod’, Apache server will still include a detailed server token in HTTP response headers, which reveals Apache version number. What the second line ‘ServerTokens Prod’ does is to suppress a server token in HTTP response headers to a bare minimal. So with both lines in place, Apache will not reveal Apache version info in either web pages or HTTP response headers. Hide PHP Version Another potential security threat is PHP version info leak in HTTP response headers. By default, Apache web server includes PHP version info via “X-Powered-By” field in HTTP response headers. If you want to hide PHP version in HTTP headers, open php.ini file with a text editor, look for “expose_php = On”, and change it to "expose_php = Off" On Debian, Ubuntu, or Linux Mint: $ sudo vi /etc/php5/apache2/php.ini On CentOS, Fedora, RHEL or Arch Linux: $ sudo vi /etc/php.ini expose_php = Off Finally, restart Apache2 web server to reload updated PHP config file. Now you will no longer see “X-Powered-By” field in HTTP response headers. Src: http://ask.xmodulo.com/turn-off-server-signature-apache-web-server.html Related Administrations Apachephp
Troubled with broken Unicode Bengali fonts on onlyoffice document server February 24, 2023 I was observing an issue on using bengali unicode font on my nextcloud integrated onlyoffice server. After spening a lot hours over google- I found the following pieces of information- I was using onlyoffice server version 6.2 and on which the bengali font gets obfuscated and broken. After reading the… Read More
Start Docker container after linux boot February 7, 2024 Docker provides restart policies to control whether your containers start automatically when they exit, or when Docker restarts. Restart policies start linked containers in the correct order. Docker recommends that you use restart policies, and avoid using process managers to start containers. Restart policies are different from the –live-restore flag of the dockerd command. Using –live-restore lets you… Read More
Reboot Windows 10 using RDP March 26, 2022 This article is for sysadmins who know better, wanting to Shut down or Restart (or even enter Sleep) over RDP anyway. Using Command Prompt Open a Command Prompt a. To initiate a Shut down, type: shutdown /s /t 0 then press Enter Related Read More