I have web Apache servers with Jessie or Stretch that have been upgraded successively from older versions of Debian (from Squeeze onwards, depending on the servers).

In all of them, I have Apache with security.conf having configured the directives ServerTokens Prod and ServerSignature off according to this question The Hosting History OS is unknow in the www.netcraft.com .

I also have checked out security.conf is present in the conf-enabled directory in all of them (it is).

Now it comes the most interesting part; some of them do not honour that configuration; and some of them do. The only pattern I was able to establish is that recently installed servers with Apache configured from scratch do not exhibit that behaviour (e.g. they always honour the configuration).

What could be happening?


Interestingly enough, to use this, and other configurations, the /etc/apache2/conf-enabled directory has to be included in /etc/apache2/apache2.conf as is done by default in later Apache versions with the line:

IncludeOptional conf-enabled/*.conf

What happened is that in some other servers, while upgrading, the old configuration file apache2.conf was kept without adding that directive. To add to the confusion, at least in one server that was spotted and corrected, so it skewed establishing that pattern.

Thus, apparently, while it appeared those security directives were configured, they were not being used by Apache. Apache was assuming the default values for ServerTokens and ServerSignature instead, which for the former is Full and for the latter, On.

I ended up adding to the end of /etc/apache2/apache2.conf

IncludeOptional conf-enabled/*.conf

After restarting the Apache service, the situation was corrected, and Apache no longer reports extra configuration data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.