One of the HTTP headers that the Apache
httpd sends back with response data is "Server". For example, my web server machine is relatively up-to-date Arch Linux. It sends back headers closely resembling the following:
HTTP/1.1 404 Not Found Date: Thu, 10 Apr 2014 17:19:27 GMT Server: Apache/2.4.9 (Unix) Content-Length: 1149 Connection: close Content-Type: text/html
ServerSignature off in
/etc/httpd/conf/httpd.conf, but the "Server:" header still appears. I have experimented with mod_headers. I have it enabled, and I've tried a few things:
<IfModule headers_module> Header set ProcessingTime "%D" Header set Server BigJohn </IfModule>
After stopping and starting
httpd with the above configuration, the HTTP headers include something like
ProcessingTime: 1523, but the "Server:" header line remains unchanged. So I know that "mod_headers" is installed and enabled, and working, but not as I desire.
I see that something called "mod_security" claims to do this, but I don't want all the rest of the baggage that mod_security carries with it.
Once you get
mod_security installed, you only need a few directives:
<IfModule security2_module> SecRuleEngine on ServerTokens Full SecServerSignature "Microsoft-IIS/6.0" </IfModule>