6 ms·

Secure Apache and PHP, hide version numbers

4 points by darkduck 15y ago

route66 15y ago
Hmmm .. Security by obscurity? When I look at my server logs I see lots of attempts to crack into software, components or programming languages I do not use and which can't be found on the server. The common cheap hacking script doesn't even care if it's a windows box when it's dumbly requesting the isapi.dll. I wonder if the effect is the same as grinding the lock-makers label off my door locks.
- nodata 15y ago
  Removing version information makes it more difficult for an unskilled automated attack on a server, which is what most of the attacks are.
  - route66 15y ago
    That's my point: For an attack I just send my php 4.1 patchlevel nnn specific script I just bought to 200.000 webservers on some it will work. This is indeed the majority of attempts I'm seeing. So it would break only attacks which do a switch on version specific information. My guess is that it would nor lower the number of attempts nor the success rate, a target will be found anyway, version information or not. I would guess that scripts which bail out humbly in absence of version information are not in the majority, but I could be wrong.
  - cheald 15y ago
    Obscuring the version number just means that Joe Blackhat has to run through 10 exploits to try to get a hit, rather than just 1. The time difference is likely insignificant. All this does is produce a false sense of security which may lull system administrations into putting off critical upgrades.
    - nodata 15y ago
      Joe Blackhat isn't running the exploits - Sam Scriptkiddie is. > All this does is produce a false sense of security which may lull system administrations into putting off critical upgrades. Then the sys admin needs replacing. Creating more work for those that automate system attacks is a good thing.
- SaltwaterC 15y ago
  Most of the "security" is in fact obscurity: here's something I know, you don't, while in order to find out what I know is unfeasible for you to compute all the possible combinations. Same goes for the "randomness" theory.
DrinkWater 15y ago
WOW, This is the most basic of basic basics. I wouldn't expect such posts on Hacker News
- syaz1 15y ago
  Your comment is void of content. Many do not like such posts on HN.
rphlx 15y ago
Security issues aside, another reason to turn off the http server version is that it pointlessly consumes presumably-metered bandwidth.
static_cast 15y ago
If I'd like to "hack" a LAMP-Server I certainly wouldn't start by attacking Apache or PHP. The biggest attack vector are outdated scripts. Once an attacker has access to PHP, he basically has a normal user login. Running PHP as the apache user gives the attacker full read access to all your web-folders. If I where him, I'd put 2 lines code into the PHP-Webmail script to send me your e-mail logins and from there I can research further... using fastcgi for php, block/log outgoing traffic per uid/gid, disable sockets for php uids, use suhosin to disallow certain php calls, nosuid,noexec webroot/tmp nothing really protects you against a mildy creative attacker... I'm a sysadmin for a dozen LAMP shared hosting sites used by non-tech users and keeping these things secure is a major pain in the ass. especially if your users want to use these riciolous unsecure php scripts. joomla die in a fire... I'm sorry disabling version numbers is good idea but calling it "securing" your server is idiotic. /rant

4 points by darkduck 15y ago

Hmmm .. Security by obscurity? When I look at my server logs I see lots of attempts to crack into software, components or programming languages I do not use and which can't be found on the server. The common cheap hacking script doesn't even care if it's a windows box when it's dumbly requesting the isapi.dll. I wonder if the effect is the same as grinding the lock-makers label off my door locks.

nodata 15y ago
Removing version information makes it more difficult for an unskilled automated attack on a server, which is what most of the attacks are.
- route66 15y ago
  That's my point: For an attack I just send my php 4.1 patchlevel nnn specific script I just bought to 200.000 webservers on some it will work. This is indeed the majority of attempts I'm seeing. So it would break only attacks which do a switch on version specific information. My guess is that it would nor lower the number of attempts nor the success rate, a target will be found anyway, version information or not. I would guess that scripts which bail out humbly in absence of version information are not in the majority, but I could be wrong.
- cheald 15y ago
  Obscuring the version number just means that Joe Blackhat has to run through 10 exploits to try to get a hit, rather than just 1. The time difference is likely insignificant. All this does is produce a false sense of security which may lull system administrations into putting off critical upgrades.
  - nodata 15y ago
    Joe Blackhat isn't running the exploits - Sam Scriptkiddie is. > All this does is produce a false sense of security which may lull system administrations into putting off critical upgrades. Then the sys admin needs replacing. Creating more work for those that automate system attacks is a good thing.
SaltwaterC 15y ago
Most of the "security" is in fact obscurity: here's something I know, you don't, while in order to find out what I know is unfeasible for you to compute all the possible combinations. Same goes for the "randomness" theory.

DrinkWater 15y ago

WOW, This is the most basic of basic basics. I wouldn't expect such posts on Hacker News

syaz1 15y ago
Your comment is void of content. Many do not like such posts on HN.

rphlx 15y ago

Security issues aside, another reason to turn off the http server version is that it pointlessly consumes presumably-metered bandwidth.

static_cast 15y ago

If I'd like to "hack" a LAMP-Server I certainly wouldn't start by attacking Apache or PHP. The biggest attack vector are outdated scripts. Once an attacker has access to PHP, he basically has a normal user login. Running PHP as the apache user gives the attacker full read access to all your web-folders. If I where him, I'd put 2 lines code into the PHP-Webmail script to send me your e-mail logins and from there I can research further... using fastcgi for php, block/log outgoing traffic per uid/gid, disable sockets for php uids, use suhosin to disallow certain php calls, nosuid,noexec webroot/tmp nothing really protects you against a mildy creative attacker... I'm a sysadmin for a dozen LAMP shared hosting sites used by non-tech users and keeping these things secure is a major pain in the ass. especially if your users want to use these riciolous unsecure php scripts. joomla die in a fire... I'm sorry disabling version numbers is good idea but calling it "securing" your server is idiotic. /rant