Re: response header fields

[Aarón Mizrachi <unmanarc () gmail com>]

On Miércoles 12 Agosto 2009 11:00:48 Edjenguele escribió:
> Hi as I know, suppressing Apache headers informations could be done by
> two way
> 1) patch Apache and recompile the source code, probably the best way
> 2) modify/wrap response from java code using a servlet.
>
> Andre Rodrigues wrote:
> > Hi,
> >
> > Can you tell me what response headers do I need to suppress in order to
> > improve security?
> >
> > Response headers example:
> >
> > Server:      Apache-Coyote
> > x-powered-by: <My server information>
> >
> >
> > I think the above headers inform too much, so I will remove them.
> >
> > Am I paranoid, or is it a good practice?
In terms of security, you are doing nothing. In terms of impact and 
probability of penetration, you are reducing risks, what is good.

In conclusion: yes, is a good practice. 

But, be careful on recompilation. Remember to maintain a good patch management 
policy in time on handy compiled applications. I suggest you to use the patch 
strategy.  It's better to loose your mask on update, rather than loose your 
patchs.

> >  Thanks,
> > André
> >
> >
> >
> >
> >
> > ------------------------------------------------------------------------
> > Securing Apache Web Server with thawte Digital Certificate
> > In this guide we examine the importance of Apache-SSL and who needs an
> > SSL certificate.  We look at how SSL works, how it benefits your company
> > and how your customers can tell if a site is secure. You will find out
> > how to test, purchase, install and use a thawte Digital Certificate on
> > your Apache web server. Throughout, best practices for set-up are
> > highlighted to help you ensure efficient ongoing management of your
> > encryption keys and digital certificates.
> >
> > http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f
> > 727d1
> > ------------------------------------------------------------------------

-- 
Ing. Aaron G. Mizrachi P.    

http://www.unmanarc.com
Mobil 1: + 58 416-6143543
Mobil 2: + 58 424-2412503
BBPIN: 0x 247066C1

Attachment: signature.asc
Description: This is a digitally signed message part.