AIAI Smart Summary (TL;DR)
Collapse

-There are two repair methods:

复制代码
1. Directly hide nginx version information
2. Modify the name and version information of the nginx used by the web server

1. Directly hide nginx version information

shell 复制代码
#Add content
[root@VM_0_12_centos conf]# vim nginx.conf
server_tokens off;
shell 复制代码
 When you grab the bag on the browser console, you can see:
 **Response Headers**
	Accept-Ranges: bytes
	Content-Length: 739
	Content-Type: text/html
	Date: Tue, 30 Jun 2020 07:53:36 GMT
	ETag: "5e9bc167-2e3"
	Last-Modified: Sun, 19 Apr 2020 03:11:35 GMT
	Server: nginx

2. Modify the name and version information of the nginx used by the web server

shell 复制代码
(1) A total of three documents need to be revised. Including:

    ·nginx.h file in src/core directory
    ·File ngx_http_header_filter_module.c in src/http directory
    ·ngx_http_special_response.c file in src/http directory

(2) The modification is as follows:
 [root@VM_0_12_centos core]# vim nginx.h
 #define NGINX_VERSION      "" 
 #define NGINX_VER          "CSDN" NGINX_VERSION
 
 [root@VM_0_12_centos http]# vim ngx_http_header_filter_module.c
 static u_char ngx_http_server_string[] = "Server: CSDN" CRLF;
 
 [root@VM_0_12_centos http]# vim ngx_http_special_response.c
 static u_char ngx_http_error_tail[] =
 "<hr><center>CSDN</center>" CRLF
 "" CRLF
 "" CRLF

 (3)Recompile nginx and launch
     [root@VM_0_12_centos nginx]# ./ configure --prefix=/usr/local/nginx
 	 [root@VM_0_12_centos nginx]# make &amp;&amp; make install
 	 [root@VM_0_12_centos sbin]# kill -9 PID
 	 [root@VM_0_12_centos sbin]# ./ nginx -c

/usr/local/nginx/conf/nginx.conf #Reload the configuration file and boot

(4) When you grab the bag on the browser console, you can see:
  **Response Headers**
 	Accept-Ranges: bytes
 	Content-Length: 739
 	Content-Type: text/html
 	Date: Tue, 30 Jun 2020 07:53:36 GMT
 	ETag: "5e9bc167-2e3"
 	Last-Modified: Sun, 19 Apr 2020 03:11:35 GMT
 	Server: CSDN

-I suggest you choose the second method. Although there may be more files and operations to modify, the second method is safer than the first method.

Original link: Fix the vulnerability of HTTP header information leaking Nginx version information

Comments & Discussions

Write a comment...
0 / 500
Comments & Discussions (0)
暂无评论,快来抢占第一条沙发吧~
0
0
AIAI