Hiding server version information from hackers
Web, mail, FTP and SSH servers all leak versions by default.
- Answers
- Why should you hide server version information, and where does it leak?
- Topics
- SSH · cloud · cyber-security · data · hacking · howto · linux · networking · programming · server · web · work
- Full article on willem.com
- https://willem.com/en/2018-03-10_cyber-security-5-easy-tips-to-protect-your-server-against-hackers/
Summary
Version numbers let hackers look up known vulnerabilities for your exact software. In 2018 I stripped them from HTTP headers, mail server hello banners, x-powered-by headers, FTP greetings and OpenSSH, which advertised operating system information by default.
Full text
Every server type leaks somewhere. Web servers like Apache, NGINX and IIS put versions in HTTP headers. Mail servers such as Postfix, Exim, Dovecot and Sendmail announce theirs in the hello banner right after an SMTP, IMAP or POP3 connection. PHP, .NET and Java add an x-powered-by header. WordPress leaks through HTML output and the filenames of CSS, JavaScript and images from plugins and themes. FTP, SFTP and WebDAV servers greet you with their version before you even authenticate, and OpenSSH communicates operating system version info by default. Hiding versions is one of five measures I recommend, next to installing less software, a firewall that blocks by default, SSH key authentication instead of passwords, and checking logs and updates regularly.