17

How serious a security problem is it to have the name of the web server in the HTTP header (Apache, Nginx etc.)?

I am discussing this with a system administrator and he told me that deleting version is easy, but deleting the name of the server (in our case nginx) is not so simple and it takes more time.

So, he thinks that it is useless, because, there are a lot of tools that are able to detect the type of server based on HTTP header.

On the other side, I have always read that information like this should be removed.

My question is - Is information like this a serious problem and should be removed, or not? (I assume fully patched server)

13
  • 17
    If you visit netflix.com/404 then it will reveal server: nq_website_nonmember-prod-release b521e844-f2f6-4b97-8c9f-0e0d05283f97. Netflix decided it was more important to reveal details about a problematic web request than it was to obscure this information from script kiddies. microsoft.com/404 reveals x-azure-ref. As long as you're not using something defunct like AOL Server then hiding the version number would suffice in my opinion. You need to specify your threat model.
    – MonkeyZeus
    Commented Oct 25, 2022 at 18:07
  • 9
    Please specify HTTP Response header. I came to look at this question because I was thinking the name of the server was absolutely required in the Request header. :)
    – Auspex
    Commented Oct 26, 2022 at 13:24
  • 4
    Not only is it not a serious problem: it is not a problem at all. Letting attackers know the type of web-server, the version of it, what OS it's running on, the name of the machine it's on, and how it's configured, does not affect the security of the system. It only affects the obscurity of the system. And obscurity is not security.
    – Ian Boyd
    Commented Oct 27, 2022 at 14:49
  • 1
    @IanBoyd I would agree if it weren't for the utterly reprehensible state of software security that exists today. Consider this scenario: a critical vulnerability for your webserver is published while you are sleeping. Guess what happens next? A bunch of nefarious actors looking for any vulnerable servers. Do you really want to make their job easy? Now weigh that against the benefit of telling your clients what webserver you use.
    – JimmyJames
    Commented Oct 27, 2022 at 20:38
  • 4
    @JimmyJames Whats to stop the attacker just trying the vulnerability anyway? How many of the attacks you see are wordpress vulnerability attacks against server that aren't running anything to do with wordpress because its cheaper to run the attack than it is to check if the server is running wordpress. If you can't patch it in time you are going to get broken into. Commented Oct 28, 2022 at 12:27

5 Answers 5

25

Assuming that the server is fully patched and you're just talking about product name and not version, I wouldn't generally regard this as a serious problem.

Essentially all security hardening is a trade-off between effort and risk reduction. Here you would potentially be reducing the risk marginally of a successful attack, but at the cost of effort to implement. In reality there's likely other places the same effort could be spent, to better effect.

In an ideal world you don't give possible attackers any information you don't have to as it makes their lives harder and forces them to spend more effort on each attack, but with things like product name (especially for common products like nginx) that's a pretty marginal benefit.

1
  • 3
    It's fully patched until it isn't. That's the problem.
    – JimmyJames
    Commented Oct 27, 2022 at 20:38
41

Any competent vulnerability scanner won't check for headers or similar information; instead, it'll just try dozens or hundreds of known attacks and checks if one if them works.

Why that? Because there's so many reasons why the header info might be wrong.

You might, for example, be using a long term release of Ubuntu, Debian, or RedHat. In long term releases, they typically fix the version number when the release comes out; during the lifetime of the OS release, they'll backport fixes but won't upgrade the version. So your "SuperServer 1.2.3" will, after a while, still announce itself as "Superserver 1.2.3" but include all the fixes (but not features) up to version 1.2.17.

For all but the smallest web sites, you'll connect to some kind of load balancer or reverse proxy which distributes your request to one of several backend servers. But there's only one server header. So even if it says Server: nginx you may be successful trying some apache exploit - attack the backend apache even with an nginx-based load balancer. Or vice versa.

So, any automated scanner will just try out as much as it can in order to not miss out on anything.

20-25 years ago, this kind of automated vulnerability scanning didn't exist, or at least wasn't as widespread/easy to as today. In those days, some people would actually try to find out stuff about server software, look up vulnerability lists, and try exploit those manually, themselves. But today? Not a chance.

1
  • 7
    With easy access to high bandwidth connections and zombie bot-nets, there's just no point performing precision attacks when carpet bombing is easier and more reliable. The internet is literally a giant threat actor and you should protect your server as such anyways.
    – Nelson
    Commented Oct 26, 2022 at 15:17
11

On the long list of things you can do to protect a server on the internet, not exposing the name of the web server barely rates.

The version number may be of more concern, since it may in theory help attackers target older or known vulnerable servers. But even this may not be particularly useful, since older servers may still be patched or may not have the vulnerable part enabled/configured.

By the time an attacker has put in the effort to query your server to try and determine what software it's running, it may as well just have probed for the actual vulnerability anyway which in most cases would be more efficient.

2
  • I think you are getting the process backwards. The attacker could already know what it's running, because you told them before the vulnerability was found. It's trivial to maintain a list of servers and what platform they report they are running. In other words, they don't need to query your server. They just go attack it because they know it's a potential target.
    – JimmyJames
    Commented Oct 28, 2022 at 17:25
  • Jimmy I am having trouble understanding what you mean. You say it's trivial to maintain a list of servers and their platforms, but it isn't really, that indicates you've already done the work to query a lot of servers to try and fingerprint them, and stored the results. If you took the same starting list of IP addresses and just tried to run exploits on them one by one, you are doing both in one pass and you don't need to store any results in the meantime. Program the exploit so it fails fast if it's not going to work and it shouldn't take significantly longer either. Commented Oct 31, 2022 at 4:06
0

It is a security concern to include the web server name and version in the HTTP response header. While not a vulnerability, your team and you should have a benefits-risk balance.

When an attacker looks for a vulnerability, their first step is information gathering. Here a common scenario would be web server fingerprinting. This to be sure with what type of file structure the attacker has to expect from the web server.

We suppose the latest patches for your webserver. It does not stop the attacker from making oriented guesses about web server languages. This can also assist attackers in exploiting other vulnerabilities that may exist.

When this kind of data is absent or obfuscated, the attacker has to change strategies. He has to rely on other means to identify web server technologies. They use automated, dedicated tools to compare the webserver behavior to certain requests. Also, the tools analyse server response time to certain requests across the network.

  1. Let's suppose you hide the headers. You can provide fewer clues to inexperienced hackers. Also, waste a little bit more time to more experienced attackers.

  2. But some companies prefer to include them. This is because they want better monitoring of their own infrastructure. Can your production team have another safer way of checking the server version?

A group like OWASP believe that the first is the correct way to go.

-1

"I am discussing this with a system administrator and he told me that deleting version is easy, but deleting the name of the server (in our case nginx) is not so simple and it takes more time."

How much time does it really take?

  • Go to nginx config folder (cd /etc/nginx/) and open the configuration file (nginx.conf)
  • Add server_tokens off; under http section.
  • Restart Nginx webserver (sudo systemctl restart nginx)

You've spent more time asking this question, I imagine.

1
  • 1
    That only hides version information, NOT the name nginx. To remove the header, you have to use an empty string, which in turn is only available when you have a commercial subscription.
    – thecarpy
    Commented Oct 29, 2022 at 10:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .