General discussion


Security Solutions: Obscure Web servers

By discussion ·
In this week's Security Solutions e-newsletter column, Mike Mullins talks about hiding valuable information that?s being served by your Web server. Does your Web server broadcast identifying information? If not, what steps did you take to hide this valuable information?

If you'd like to learn more about the Security Solutions e-newsletter, point to this link and click Security Solutions to see a sample. If you're interested, you can also sign up: eturn_to=

* When pasting this link into your browser, remove any spaces.

This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Comments

Collapse -

Not a great benefit to change banners

by thomas.nilsen In reply to Security Solutions: Obscu ...

Changing bannes on various services like http/ftp/smtp doesn't quite give you as much "added" security today as most people think.

Most services are detectable by fingerprinting without having to relay on the banner supplied (just as one can do with the OS using ICMP pings). Run Nessus on a re-branded IIS box or a Postfix installation, and it will in most cases tell you what it is, not what the banner says it is.

It is a quick fix that might keep script kiddies away for a short while, but it won't keep your box secure.

Collapse -

Security by Obscurity is bad advice

by the_integrator In reply to Security Solutions: Obscu ...

People who tend to rely on security by obscurity often do not properly lockdown their systems. Their are other methods of fingerprinting an OS other than web page responses. These inlcude responses to specific packets recieved which are often different depending on OS or application. Rather than obsecurity use the need to know principle i.e. if the person does not need to know something to perform a funstion don't tell them. This means not just delivering basic header information but also things like not even responding if a port should not be available (often called stealthing in firewall terms)
Lockdown, turn off, patch and only provide information on a need to know basis for a strongly protected system.

Related Discussions

Related Forums