CODEWITHSUNDEEP
securityhttpobfuscationheader
AML
AML

Reputation: 342

Obfuscating server headers

I have a WSGI application running in PythonPaste. I've noticed that the default 'Server' header leaks a fair amount of information ("Server: PasteWSGIServer/0.5 Python/2.6").

My knee jerk reaction is to change it...but I'm curious what others think.

Is there any utility in the server header, or benefit in removing it? Should I feel uncomfortable about giving away information on my infrastructure?

Thanks

Upvotes: 0

Views: 3403

Answers (3)

rook
rook

Reputation: 67019

Masking your version number is a very important security measure. You do not want to give the attacker any information about what software you are running. This security feature is available in the mod_security, the Open Source Web Application Firewall for Apache: http://www.modsecurity.org/

Add this line to your mod_security configuration file:

SecServerSignature "IIS/6.0"

Upvotes: 0

Arjan
Arjan

Reputation: 23529

Given the requests I find in my log files (like requests for IIS-specific bugs in Apache logs, and I'm sure IIS server logs will show Apache-specific requests as well), there's many bots out there that don't care about any such header at all. I guess almost everything is brute force nowadays.

(And actually, as for example I've set up quite a few instances of Tomcat sitting behind IIS, I guess I would not take the headers into account either, if I were to try to hack my way into some server.)

And above all: when using free software I kind of find it appropriate to give the makers some credits in statistics.

Upvotes: 1

Satanicpuppy
Satanicpuppy

Reputation: 1587

Well "Security through Obscurity" is never a best practice; your equipment should be able to maintain integrity against an attacker that has extensive knowledge of your setup (barring passwords, console access, etc). Can't really stop a DDOS or something similar, but you shouldn't have to worry about people finding out you OS version, etc.

Still, no need to give away information for free. Fudging the headers may discourage some attackers, and, in cases like this where you're running an application that may have a known exploit crop up, there are significant benefits in not advertising that you're running it.

I say change it. Internally, you shouldn't see much benefit in leaving it alone, and externally you have a chance of seeing benefits if you change it.

Upvotes: 2

Related Questions