Re: CRIME Netcraft Ethics

From: Alan (alan@private)
Date: Sun Jun 23 2002 - 21:58:01 PDT

  • Next message: Justin Kurynny: "RE: CRIME EarthLink Password Security Story"

    On Sun, 2002-06-23 at 22:42, brvarin@private wrote:
    > >From what I've been told, some Microsoft developers attempted to make it
    > much easier to modify this but the marketing geniuses said no because if
    > more clients did this, Microsofts market share would appear to be less.
    > I'm not sure what Apache's excuse is.
    > 
    > With IIS I believe all  you have to change the file
    > Winnt\System32\Inetsrv\W3SVC.DLL file.  The caveat there is that it
    > normally will say: Microsoft-IIS/5.0 but if you replace it, you have to
    > have the same number of characters.... It'd be kind of cool to put in
    > something like: Palm OS Webserver. Sure if you are really determined you
    > can figure it out but it would throw scripts and scanners off.
    
    Actually it turns out to be incredibly easy to fix this in Apache. (As
    long as you are running at least version 1.3 or greater.)
    
    In httpd.conf, look for a directive called "ServerTokens".  If it is not
    there, add it in.  (Should be located near "ServerType".
    
    Change it to:
    
    ServerTokens prod
    
    Restart the server after making the change.
    
    This will return "Apache" instead of "Apache 1.3.23 mod_perl 6.6.6,
    etc".
     
    



    This archive was generated by hypermail 2b30 : Mon Jun 24 2002 - 00:12:09 PDT