Apache ServerTokens

The Apache’s ServerTokens directive controls whether Server response header field which is sent back to clients, includes a description of the generic OS-type of the server as well as information about compiled-in modules.

As many worms/viruses check the Server header before attempting an exploit in order to choose the best attack available, it could be a good idea to provide the minimal information possible (the default is to provide full information). Edit your httpd.conf and add the following:

ServerTokens Prod

This will only send the string Apache in the Server header.

Note that this would not stop skilled bad guys, but would slow down those kiddies playing around.

Leave a Reply

You must be logged in to post a comment.