This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "SCG WS Apache"
(→Misconfiguration) |
(→Apache Server Information) |
||
| Line 6: | Line 6: | ||
| − | == Apache Server Information == | + | == Apache Server Information Leakage == |
=== Server Token === | === Server Token === | ||
| Line 12: | Line 12: | ||
==== Description ==== | ==== Description ==== | ||
| − | By Default Apache ServerToken directive | + | By Default Apache ServerToken directive reveals the below information. |
<pre> | <pre> | ||
| Line 18: | Line 18: | ||
</pre> | </pre> | ||
| − | This allows attackers to identify | + | This allows attackers to identify web servers details greatly and increases the efficiency of any attack,as security vulnerabilities |
are dependent upon specific software versions. | are dependent upon specific software versions. | ||
==== How to test ==== | ==== How to test ==== | ||
| − | In order to test for ServerToken configuration, one should check the | + | In order to test for ServerToken configuration, one should check the Apache configuration file. |
==== Misconfiguration ==== | ==== Misconfiguration ==== | ||
| Line 31: | Line 31: | ||
==== Remediation ==== | ==== Remediation ==== | ||
| − | Configure the ServerTokens directive in the | + | Configure the ServerTokens directive in the Apache configuration to value of Prod or ProductOnly |
<pre> | <pre> | ||
| Line 38: | Line 38: | ||
ServerTokens ProductOnly | ServerTokens ProductOnly | ||
</pre> | </pre> | ||
| − | |||
== References == | == References == | ||
Revision as of 16:36, 5 October 2015
This article is part of the OWASP Secure Configuration Guide.
Back to the OWASP Secure Configuration Guide ToC: https://www.owasp.org/index.php/Secure_Configuration_Guide Back to the OWASP Secure Configuration Guide Project: https://www.owasp.org/index.php/OWASP_Secure_Configuration_Guide
Summary
The Apache HTTP Server Project is a collaborative software development effort aimed at creating a robust, commercial-grade, featureful, and freely-available source code implementation of an HTTP (Web) server. The project is jointly managed by a group of volunteers located around the world, using the Internet and the Web to communicate, plan, and develop the server and its related documentation. This project is part of the Apache Software Foundation. In addition, hundreds of users have contributed ideas, code, and documentation to the project. This file is intended to briefly describe the history of the Apache HTTP Server and recognize the many contributors.
Apache Server Information Leakage
Server Token
Description
By Default Apache ServerToken directive reveals the below information.
Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5
This allows attackers to identify web servers details greatly and increases the efficiency of any attack,as security vulnerabilities are dependent upon specific software versions.
How to test
In order to test for ServerToken configuration, one should check the Apache configuration file.
Misconfiguration
ServerTokens Full
Remediation
Configure the ServerTokens directive in the Apache configuration to value of Prod or ProductOnly
ServerTokens Prod or ServerTokens ProductOnly
References
https://httpd.apache.org/docs/current/misc/security_tips.html
