How (and why) to disable apache server signature on your web pages

In the default configuration of Apache, any error pages will contain the full signature of the server (version number) which could be exploited by hackers. Each version has some deficiencies that could be exploited, and a hacker who knows your version number may benefit from it by focused attacks.

To disable server signature, you will need to edit your /etc/apache2/apache2.conf file.

sudo nano /etc/apache2/apache2.conf

Press Ctrl+w to search for "ServerSignature" and press return. If you find it, edit it to:

ServerSignature Off
ServerTokens Prod

If you don't find it, just scroll to the end of the file and add these two lines.

Then, we need to reload apache configuration to put this new change in effect:

sudo /etc/init.d/apache2 reload

Check the new configuration by entering an invalid address on your server URL (e.g. www.server.com/invalidpage.html). You should not see the server signature now, just the server name.

Deny.hosts file

I described last week how many (zombie) computers are attempting to gain anauthorized access to my server via open SSH port. Though I haven't been able to configure my iptables firewall as per my wishes, here's a temporary fix:

This guy has released his hosts.deny file to the public, so that we can ban these bad guys. Just copy it to your /etc/ directory (overwriting existing deny.hosts file) and restart your network or computer. It'll start working straightaway.

Additionally, here is a very nice and easy tutorial about installing denyhosts, an automated program which scans your logs for multiple unauthorized login attempts, and bans those hosts from accessing your computer।

To install Denyhosts on Ubuntu:
sudo apt-get install denyhosts

The default installation of Denyhosts in Ubuntu comes with reasonably secure default settings. It also adds a daemon at startup! Being a zero-configuration daemon, I recommend it over fail2ban (which does require configuration by hand in Ubuntu).

Empty iptables in Ubuntu default installation

Now that my site is famous (almost), I'm beginning to think about security. Actually I should have thought about it even before opening the site to the public. So here I am, sitting in front of my black box, thinking about security.

Googling around for some time revealed more details about a word I happened to know previously - "iptables". A quick check at my iptables configuration in default ubuntu installation revealed that I do not have any firewall rules set at all! Now, this makes me think twice about my server security. How then, no one was able to hack the site?

The answer is my router. It has an in-built firewall, which I had configured to allow only ports 80 (HTTP) and 22 (SSH). I would just have port 80 open, but I needed remote management. So I opened port 22 as well.

I'll find more details about server security, and post them here.