Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 6 down vote favorite

I just noticed that my 403 Forbidden (the default, not a custom one) page displays some server info:

Apache/2.2.3 (Red Hat) Server at ... Port 80

Is revealing this information a security risk?

share|improve this question

3 Answers

up vote 9 down vote accepted

Revealing that information is a security risk, in the context of a security assesment of your website. (I'm talking about checkbox style assesments here)

Nothing more than that - it just makes fingerprinting the webserver more difficult, but by no means impossible - not even hard. It will not hinder any attacker specifically targeting the website not even a bit, although it will force him to take actions that will possibly hit some IDS. It may hinder some automated crawlers or mass attacks. though.

I would categorise this to the 'best practices' list.

share|improve this answer
up vote 8 down vote

Directly, no. This is a matter of security through obscurity. Removing the server headers do not remove the vulnerabilities and functions associated with it.

In the context of risk, it might decrease the possibility to be targeted by some automated bots who rely on fingerprinting your services. The consequences would remain the same.

This question have already covered this discussion about security through obscurity to a good extent.

share|improve this answer
2  
Agreed, knowing the server and version should not make you less secure if you have good patch management, hardening, access control, monitoring etc. But good practice is to minimize the amount of un-required information you leak to an attacker. – Rakkhi Jun 30 '11 at 14:32
5  
Right, the most compelling argument I read from the provided link, was that removing information about running services, forces the attacker to provide more network noise to determine what you are running. – Dog eat cat world Jun 30 '11 at 14:34
1  
exactly. If you don't just "give it" to them, they are potentially either going to have to do some noisy reconnaissance or 'guess' about what versions you are running (and thus possible try some attack avenues that are 'closed' and make even more noise) – DKGasser Jun 30 '11 at 19:49
up vote 2 down vote

It definitely provides some interesting information to possible attackers about your system (operating system, web server type and version). So i guess that it would be wise to either remove that information completely or change to something more generic/user friendly.

You should check your httpd.conf file for ServerTokens and ServerSignature in order to make the relevant changes.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.