Hiding Software Versions - A Step Forward to a Secure Server

drendeah · #1 08-11-2008

Hiding Software Versions - A Step Forward to a Secure Server
By drendeah

Most of you may not notice, or may not care, about the software versions that get revealed by the running services on your server. By default almost all services reveal some information to the clients that use them. Among this information is the version of the software that is being run. It has always been best practice, not to reveal more than it is needed. Why reveal the version of the service when nobody needs to know it? By letting these details be seen, you don't get anything else, but an extra chance for crackers to break into your server.

Let's suppose that you have an old software running, and it's configured to show it's version. For a cracker who scans the internet periodically it will be very easy to hack into your server if he already has some knowledge about your server. You will help him narrow his attempts only to those related to your software version.

So, by hiding the software version you make life harder for hackers/crackers. Of course you should, at all times, keep your system up to date, but in case you forget or something happens and you are unable to do so, why not take extra care and give as little information as possible to the outside world.

I will now show you how to change this default behaviour for some popular software on Ubuntu 8.04.1 Server.

Postfix

By default postfix will advertise itself as

Code:

domainname ESMTP Postfix (Ubuntu)

Now we don't care if it tells the world it's Postfix, but why should we reveal that we run Ubuntu after all? Let's change this.

Edit the file /etc/postfix/main.cf and look for this line:

Code:

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)

All you have to do is modify that line so it won't show "Ubuntu" anymore.

Apache

For Apache we have to modify the file /etc/apache2/apache2.conf. Look for the following lines:

Code:

ServerTokens
ServerSignature

And set them to:

Code:

ServerTokens ProductOnly
ServerSignature Off

PHP

We should also take care of PHP, which adds an extra signature. Edit /etc/php5/apache2/php.ini
and look for the line:

Code:

expose_php = On

Set it to Off.

VSFTPD

When you install vsftpd, by default it will show the vsftpd version at ftp login. We can change this behaviour by editing the file /etc/vsftpd.conf and uncommenting the following line:

Code:

#ftpd_banner=Welcome to blah FTP service.

And of course you may change the text according to your desire.

In this tutorial I have shown you how to change the default behavior of displaying software versions for 4 popular services. You should now check your other software to see if it allows for the same configurations to be made.

This article was brought to you by LinuxSecurityForum.org, become a member by clicking here: Register