ClearFoundation Tracker - ClearOS
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0000967ClearOSapp-php - PHPpublic2013-02-01 20:292013-04-26 19:44
Reporteruser2 
Assigned To 
PrioritynormalSeveritytweakReproducibilityN/A
StatusclosedResolutionfixed 
PlatformOSOS Version
Product Version 
Target VersionFixed in Version 
Summary0000967: Disable version information for Apache and PHP
DescriptionFrom a forum post...

Here are a couple of changes that you can make that might prevent the scanner from doing version detection. You can hide the version information coming from Apache by changing the ServerTokens parameter in /etc/httpd/conf/httpd.conf:

ServerTokens Prod

Similarly for PHP, the expose_php parameter should be changed in /etc/php.ini:

expose_php = Off

Restart the web server after making the changes:

# service httpd restart

A web page request will no longer get presented with version information:
Steps To Reproduce
Additional Information
TagsNo tags attached.
Relationships
related to 0000956closed  Disable version information for Apache and PHP 
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2013-02-01 20:29user2New Issue
2013-02-01 20:29user2Issue generated from: 0000956
2013-02-01 20:29user2Relationship addedrelated to 0000956
2013-02-01 20:41user2Statusnew => confirmed
2013-02-01 20:41user2Checkin
2013-02-01 20:41user2Note Added: 0000670
2013-02-01 20:41user2Statusconfirmed => resolved
2013-02-01 20:41user2Resolutionopen => fixed
2013-04-26 19:44user2Statusresolved => closed

Notes
(0000670)
user2   
2013-02-01 20:41   
Source Code Changelog
---------------------------------------------------
- Disabled expose_php to prevent version information leak [fixed tracker 0000967]

File Changes
---------------------------------------------------
Details: http://code.clearfoundation.com/svn/revision.php?repname=ClearOS&rev=5573 [^]
U webconfig/apps/php/trunk/deploy/info.php
A webconfig/apps/php/trunk/deploy/install
U webconfig/apps/php/trunk/packaging/app-php.spec