Hide Web Server Information and Modify Server Header on Nginx.
Introduction
By default, Nginx may expose web server and operating system information through HTTP response headers. For example, a server may return a header such as Server: nginx/1.10.0 (Ubuntu).
Exposing this information can help attackers identify the web server version and operating system, which may make it easier to target known vulnerabilities. As a security best practice, it is recommended to minimise the amount of server information exposed to the public.
Prerequisites
Before proceeding, make sure you have the following:
- An Ubuntu or CentOS server.
- Nginx web server installed and running.
- Root or sudo access to the server.
- Basic knowledge of Nginx configuration.
If Nginx is not installed, follow the posts below depending on server environment.
Implementation:
We have may to install nginx-extras on ubuntu host. This post only tested with Ubuntu host. We never tried this on centos host. You can still follow this post to achieve the same.
apt-get -y install nginx-extras
Before implementing, let’s test whether the server information is exposed to the public. Open a terminal and execute the command below.
curl -I http://IPaddress
The output will be displayed as below,
HTTP/1.1 301 Moved Permanently
Server: nginx/1.10.0 (Ubuntu)
Open the nginx.conf configuration. Under the http section, identify and update/add/modify the line below
vi /etc/nginx/nginx.conf
server_tokens off; more_set_headers 'Server: PheonixSolutions'
Where,
server_tokens off will hide Os Information
more_set_headers sets user specified information.
Verify whether there are any syntax errors in the configuration.
nginx -t
Restart the nginx service.
service nginx restart
Verification:
Run the same curl command and see whether we get the same information.
curl http://IPaddress
HTTP/1.1 301 Moved Permanently
Server: Pheonixsolutions
The Nginx version and operating system information are no longer exposed through the Server header.
Conclusion
Hiding web server information is a simple security-hardening step that reduces unnecessary information exposure. By disabling Nginx version details and customizing the Server header, you can prevent visitors and automated scanners from easily identifying the exact Nginx version and operating system.
