Security

Ask something
Discussion Locked

Security Solutions: Obscure Web servers

0 helpful
2 replies

by discussion

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

In this week's Security Solutions e-newsletter column, Mike Mullins talks about hiding valuable information that?s being served by your Web server. Does your Web server broadcast identifying information? If not, what steps did you take to hide this valuable information?

----
If you'd like to learn more about the Security Solutions e-newsletter, point to this link and click Security Solutions to see a sample. If you're interested, you can also sign up:
http://nl.com.com/guest.jsp?brand=techrepublic&r eturn_to=https://www.techrepublic.com.com:8001/2001-1-0.html

* When pasting this link into your browser, remove any spaces.

2 replies

by thomas.nilsen

Changing bannes on various services like http/ftp/smtp doesn't quite give you as much "added" security today as most people think.

Most services are detectable by fingerprinting without having to relay on the banner supplied (just as one can do with the OS using ICMP pings). Run Nessus on a re-branded IIS box or a Postfix installation, and it will in most cases tell you what it is, not what the banner says it is.

It is a quick fix that might keep script kiddies away for a short while, but it won't keep your box secure.

by the_integrator

People who tend to rely on security by obscurity often do not properly lockdown their systems. Their are other methods of fingerprinting an OS other than web page responses. These inlcude responses to specific packets recieved which are often different depending on OS or application. Rather than obsecurity use the need to know principle i.e. if the person does not need to know something to perform a funstion don't tell them. This means not just delivering basic header information but also things like not even responding if a port should not be available (often called stealthing in firewall terms)
Lockdown, turn off, patch and only provide information on a need to know basis for a strongly protected system.

This discussion is closed to new replies.