Apache Obfuscation by disabling trace and server tokens
Known for his open source and JavaScript security initiatives, Liran Tal is an award-winning software developer, security researcher, and open source champion in the JavaScript community. He's an internationally recognized GitHub Star, acknowledged for his open source advocacy, and has received the OpenJS Foundation's Pathfinder for Security for his work on Node.js security. His contributions to developer security education include leading OWASP projects, building supply chain security tools, participation in CNCF and OpenSSF initiatives, and authoring books such as O'Reilly's Serverless Security. He leads the developer advocacy team at Snyk.io and is on a mission to empower developers with better application security skills.
Mar 9, 2015 ~ 1 min read
Apache Obfuscation by disabling trace and server tokens
share this story on
Apache Obfuscation can be achieved very easily and the benefits are great – it doesn’t disclose server information such as versions, OS, and does output verbose errors when ‘bad things happen’, and they happen.
Edit apache configuration, usually available here for RedHat based distributions: /etc/httpd/conf/httpd.conf
Make sure the following settings are present, save, and restart apache:
TraceEnable Off
ServerSignature Off
ServerTokens Prod
How do we test that this is actually working?
How to TraceEnable
- curl -v -X TRACE http://…
- Confirm you get a forbidden response
How test ServerTokens
- Make a request to the website and check the response headers
- Confirm the response contains only “Apache” information in the Server header
How to test ServerSignature
- Make a request to the website for a URL that should respond with Apache server error
- Confirm you don’t see information about the apache server software version, OS, etc.
