Ubuntu – Apache: “Header set Server” not working

apache-2.2Ubuntu

I'm trying to do something I thought was simple. I just want to change the Server header that Apache sends for every request. This is the line in my httpd.conf file:

Header always set Server "My Server name"

However, this is what is returned in the Server header:

Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.10 with Suhosin-Patch mod_ssl/2.2.8 OpenSSL/0.9.8g

Incidentally, that's what software I'm using (how convenient). I do have mod_headers enabled and it is working for other directives in my configuration files.

EDIT: I'm running this on Ubuntu Server 8.04 LTS x64.

Why doesn't this work?

Best Answer

That's because it's an Apache policy not to lie about the Server header and to always set it. The best you can do is to have it only display "Apache" with :

ServerSignature Off
ServerTokens Prod

As it's said in the FAQ and a bug report, the only way you can have Apache send "My Server Name" is to modify the sources.

Note also that you won't gain anything by having your server not saying you're using Apache, security through obscurity is, well, not really security. If you're trying to hide your operating system or your php or ssl versions, in case a bug arise, it's not really useful either because people tend to try getting into every server they encounter.

Related Solutions

How to Remove Request Blocking on Apache Reverse Proxy After Backend Failure

A bit late answer, but sending it in for refernce

http://httpd.apache.org/docs/2.2/mod/mod_proxy.html#proxypass

The key setting is timeout value. Default is 60 seconds, can be set to 0 for always retry.

ProxyPass /path http_//server/ retry=0

Linux – How to Give a User Permission to Restart Apache

Short answer:

Using visudo, add the following to your sudoers file, replacing username with the proper username:

username ALL = /etc/init.d/apache2

If you want to not have to type in a password before you do this, use the following:

username ALL = NOPASSWD: /etc/init.d/apache2

After this, the 'username' user can execute sudo /etc/init.d/apache2 start (or stop, restart,etc)

Long answer: You'll likely want to setup a separate user for this if you haven't already, and then configure the /etc/sudoers file to allow a user or group to execute the command you want.

For example, to allow the user 'ben' to execute all commands as root prompting for a password, you would do the following:

ben ALL= ALL

To allow 'ben' to execute only one command (like say, rm), you would do the following:

ben ALL= /bin/rm

If you are running a script as a user and don't want to prompt for a password, you'll want to use the 'NOPASSWD' option like so:

ben ALL=NOPASSWD: /bin/commandname options

You can do the same thing for groups by prefixing group names with a percentage sign, like so:

%supportstaff          ALL= NOPASSWD: /bin/commandname

Best Answer

Related Solutions

How to Remove Request Blocking on Apache Reverse Proxy After Backend Failure

Linux – How to Give a User Permission to Restart Apache

Related Topic