How (and why) to disable apache server signature on your web pages

In the default configuration of Apache, any error pages will contain the full signature of the server (version number) which could be exploited by hackers. Each version has some deficiencies that could be exploited, and a hacker who knows your version number may benefit from it by focused attacks.

To disable server signature, you will need to edit your /etc/apache2/apache2.conf file.

sudo nano /etc/apache2/apache2.conf

Press Ctrl+w to search for "ServerSignature" and press return. If you find it, edit it to:

ServerSignature Off
ServerTokens Prod

If you don't find it, just scroll to the end of the file and add these two lines.

Then, we need to reload apache configuration to put this new change in effect:

sudo /etc/init.d/apache2 reload

Check the new configuration by entering an invalid address on your server URL (e.g. www.server.com/invalidpage.html). You should not see the server signature now, just the server name.

Linux: The non-stop performer

I am hosting five websites from my home server using Linux. This "server" is a very old computer barely capable of running modern operating systems, but is running Apache web server on Ubuntu Linux successfully. I had configured this as a server many months back, and then just forgot about it. I never had any downtime problems so far (except once when I filled up the entire 1GB HDD by installing some updates leading to a kernel panic), and no crashes!

Yesterday, I just remembered I have a web-server which has been running all day and all night, and I became curious how many days it has been up. I checked, and here is what I saw:

The server was up for 91 days non-stop! I didn't have to worry about it at all! This is truly great, and I can now feel why the Linux community is so enthusiastic about their software!

Thank you Linus!

---