Improve Apache Web Server Security: Use ServerTokens and ServerSignature to Disable Header改善Apache Web服务器安全：使用servertokens和serversignature禁用标题
When Apache HTTPD web server generates any web pages or error pages, some important information about the version and other details implemented on the system are displayed in th web site server header.当Apache的httpd Web服务器产生的任何网页或错误网页，一些重要的信息有关的版本和其他细节，实施该系统显示在次网站服务器的标题。 For example, the information text may be like this:举例来说，信息文本可能会是这样的：
Server: Apache/1.3.37 (Unix) mod_auth_passthrough/1.8 mod_log_bytes/1.2 mod_bwlimited/1.4 FrontPage/5.0.2.2635.SR1.2 mod_ssl/2.8.28 OpenSSL/0.9.7a PHP-CGI/0.1b服务器： apache/1.3.37 （ UNIX的） mod_auth_passthrough/1.8 mod_log_bytes/1.2 mod_bwlimited/1.4 frontpage/5.0.2.2635.sr1.2 mod_ssl/2.8.28 openssl/0.9.7a php-cgi/0.1b
Server: Apache/2.0.53 (Ubuntu) PHP/4.3.10-10ubuntu4 Server at xx.xx.xx.xx Port 80服务器： apache/2.0.53 （ Ubuntu的） php/4.3.10-10ubuntu4服务器上xx.xx.xx.xx端口80
The line in the server header expose important version and variant information about the Linux operating system and Apache software used on the machine, indirectly expose the possible security holes that are existed to the hackers, or at least make malicious attackers easier to identify your system for available attack points.该线在服务器上的标题，揭露重要的版本和变体的资料， Linux操作系统和Apache软件使用的机器，间接揭露可能的安全漏洞是存在的黑客，或者至少使恶意攻击者更容易识别您的系统现有的攻击点。
To ensure that the Apache HTTP web server does not broadcast this message to the whole world publicly and fix possible security issue, modify these two directives ServerTokes and ServerSignature in httpd.conf configuration file.以确保Apache的HTTP Web服务器不播出这个讯息，以整个世界的公开和修复可能的安全问题，修改这两个指令servertokes和serversignature在httpd.conf配置文件。
- Login as root user or perform a sudo to the web server.以root身份登录的用户或执行sudo的到Web服务器。
- Open and edit httpd.conf or apache2.conf (in Apache 2) with vi or other text editor.打开并修改httpd.conf文件或apache2.conf （在Apache 2 ）与六或其他文本编辑器。 The Apache configuration normally located in /etc/httpd/conf/ or /etc/apache2/ or /etc/apache/ (for Apache1.3) depending on which Unix you’re using. Apache的配置通常位于在/ etc /的httpd /设置/或/ etc/apache2 /或/ etc /阿帕奇/ （ apache1.3 ）根据其中的UNIX您使用。
- Locate the line with ServerTokens .找到符合servertokens 。 You can perform a search by typing “/ServerTokes” and hit Enter.您可以执行搜索中键入“ / servertokes ”和回车键。
- In Apache 1.3, you will likely to see a line starts with #ServerTokes Full In this case, remove or delete the # character (by pressing d key).在Apache 1.3的，您可能会看到一条线开始＃ servertokes充分在这种情况下，移除或删除＃字符（按d键） 。 Also modify the Full to become Prod (press r key to replace one character, or R to replace multiple characters), so that the line becomes ServerTokens Prod .还修改了充分成为产品（按R键，以取代一个字符，或R ，以取代多个字符） ，使该线成为servertokens产品 。 In Apache 2.0 or 2.2, the line normally does not exist.在Apache 2.0或2.2 ，该行通常是不存在的。 So the search will fail.因此，搜索将失败。 In this case, go to the bottom of config file, and add the new line with the following text.在这种情况下，去底部的config档案，并添加新的符合下列文字。 You can add new line by pressing o key.您可以添加新线紧迫o的关键。
ServerTokens Prod servertokens产品
- Next, search for ServerSignature.未来，搜索为serversignature 。 In Apache13, the line should just above the line of ServerTokens.在apache13 ，该行应略高于线servertokens 。 Edit the line so that it looks like this, and in Apache2 which doesn’t already have this line, add in at new one.编辑路线，以便它看起来是这个样子，并在Apache2中不已经有这条线，加上在新一。
ServerSignature Off serversignature小康
- By now the Apache configuration file should have this two directives set as below:现在Apache的配置文件应该有这两项指令定为如下：
ServerSignature Off serversignature小康
ServerTokens Prod servertokens产品The first line “ServerSignature Off” instructs Apache not to display a trailing footer line under server-generated documents (error messages, mod_proxy ftp directory listings, mod_info output, and etc) which displays server version number, ServerName of the serving virtual host, email setting, and creates a “mailto:” reference to the ServerAdmin of the referenced document.第一行“ serversignature小康”指示的Apache不显示一个尾随页脚线下的服务器所产生的文件（错误讯息， mod_proxy FTP目录列表， mod_info输出，等） ，其中显示服务器版本号，服务器的虚拟主机服务，电子邮件设置，并创建一个“的mailto ： ”提到了serveradmin所引用的文件。
The second line “ServerTokens Prod” configures Apache to return only Apache as product in the server response header on very page request, suppressing OS, major and minor version info.第二行“ servertokens产品”配置的Apache只返回Apache的产品在服务器的响应头就非常的页面请求，抑制操作系统，主要和次要版本信息。
- Save and close the config file by pressing Shift-Colon, and then type wq keys, and hit Enter.保存并关闭配置文件由紧迫的转移结肠，然后键入wq键，回车键。
- Restart Apache.重新启动Apache的。 Typical command is service httpd restart or /etc/init.d/apache2 restart .典型的命令是服务的httpd重新启动或/ etc/init.d/apache2重新启动 。
- Now, you will get only the Apache in the server response header:现在，你会得到的唯一的Apache在服务器的响应标题：
Server: Apache服务器：阿帕奇
IMPORTANT : This is a machine translated page which is provided "as is" without warranty. 重要说明 ：这是一个机器翻译网页是“按原样”提供的担保。 Machine translation may be difficult to understand.机器翻译可能很难理解。 Please refer to请参阅 original English article英文原版的文章 whenever possible.只要有可能。
Share and contribute or get technical support and help at分享和贡献，或取得技术的支持和帮助，在 My Digital Life Forums 我的数字生活论坛 . 。
Related Articles相关文章
- Installing Web Server in FreeBSD 6.0 with Apache 2.2, MySQL 5.0 and PHP 5 - Part 4安装Web服务器在FreeBSD的6.0与2.2的Apache ， MySQL 5.0的和PHP 5 -第4部分
- Apache Status (whm-server-status) in cPanel WebHost Manager Returns Blank Page Apache的地位（的WHM服务器的地位）在网页主机的cPanel经理回报的空白页
- Easily Set Up Web Server with XAMPP很容易成立的Web伺服器与xampp
- Remove and Uninstall or Disable ModSecurity (mod_security)删除和卸载或禁用modsecurity （ mod_security ）
- Starting Apache HTTPD Failed Due to Cannot Open or No Such mod_bwlimited, mod_log_bytes or mod_bandwidth Files开始的Apache的httpd失败，由于无法打开，或没有这样的mod_bwlimited ， mod_log_bytes或mod_bandwidth档案
- cPanel WHM Failed to Receive Status Information From Apache Error的cPanel的WHM没有收到状态信息从Apache的错误
- winnt_accept: Asynchronous AcceptEx failed Error in Apache Log winnt_accept ：异步acceptex失败错误在Apache日志
- Apache Warn NameVirtualHost *:80 Has No VirtualHosts Error When Start阿帕奇警告namevirtualhost * ： 80没有virtualhosts时发生错误开始
- Install Web Server in Windows XP with Apache2, PHP5 and MySQL4 - Part 2安装Web服务器在Windows XP的Apache2 ， php5和mysql4 -第2部分
- Auto Shutdown and Restart Apache HTTPD Service Daemon at Preset Time自动关机和重新启动的Apache的httpd服务的守护进程在预设时间
