29

I can hide NGINX version by using server_tokens option set to off. But not able to change the NGINX Server signature.

Steps I did:

  1. Change the NGINX server name in source file src/http/ngx_http_header_filter_module.c to My-Server, then compiled NGINX.

But it is not working when I call the server. Strange here is I can see my updated Signature when I use curl command. But this is not updated in the browser.

  1. I tried using a 3rd party module headers-more-nginx-module.

This doesn't work either. I am getting the updated name via cURL but not in browser.

6
  • Is this how you say "thanks" to developers of nginx?
    – VBart
    Commented Jul 6, 2014 at 11:05
  • 1
    may be your browser just cached the headers? try another browser or Ctrl-F5/Ctrl-R in you current one
    – folibis
    Commented Jul 6, 2014 at 11:11
  • @folibis , Yes, I checked on different browser. but still the same :(
    – KMG
    Commented Jul 6, 2014 at 11:12
  • @folibis Yes, I've setup Nginx as a reverse proxy for apache LB. Do I need to change somewhere else?.
    – KMG
    Commented Jul 6, 2014 at 11:33
  • 4
    @VBart it's a minor way to improve security by leaking as little information as possible. Security through obscurity is an OK practice after making sure it's as secure as possible through design (i.e. it's patched and configured well).
    – Nick T
    Commented Jan 19, 2018 at 19:41

6 Answers 6

57

If you are working in ubuntu then

  1. First install nginx-extras

    sudo apt-get install nginx-extras
    
  2. Go to /etc/nginx/nginx.conf and under http add:

    http {
        more_set_headers "Server: Your_New_Server_Name";
        server_tokens off; 
    }
    
  3. Restart nginx

    sudo service nginx restart
    
2
11
  1. Install HttpHeadersMoreModule - http://wiki.nginx.org/HttpHeadersMoreModule
  2. Change it using the more_set_headers directive.
  3. Reload Nginx to take effect.

    Hide nginx version information.

    server_tokens off;

    Change the server name.

    more_set_headers "Server: MyServerName";

3
  • Already tried this and explained the same on my 2nd point. Any other way to change it.
    – KMG
    Commented Jul 7, 2014 at 10:43
  • What version are you using? It requires at least v0.7.44. Commented Jul 7, 2014 at 12:31
  • @KMG I was having the same problem using "more_set_headers". The fact that it worked in "curl" indicated it worked. Turned out the browser was caching the requests. Once I cleared that up the problem was fixed. Commented May 24, 2017 at 18:03
11

Go to nginx conf and switch off server_tokens.

/etc/nginx/nginx.conf

server_tokens off;
1
9

You can use this in your Nginx config.

proxy_pass_header Server;
1
  • 3
    Could you elaborate a little more? This works if you are reverse proxying some backend server. Is there some other case where this would work? Commented Jul 19, 2019 at 16:21
3

I was facing the same issue. In the server part, I added

server_tokens off; // This will remove version

And in the HTTP part added

proxy_pass_header Server; //Server name and version will be hidden

Final nginx.conf file looks like :

server {
        listen 9090;

       server_tokens off;

        location / {
                access_log off;
                add_header Content-Type text/plain;
                return 200;
        }
        location /test {
                rewrite /test/(.*) /$1  break;
                proxy_pass         http://localhost:9090;
                proxy_redirect     off;
                proxy_set_header   Host $host;

                proxy_pass_header Server;

                client_max_body_size 200M;
                proxy_connect_timeout      240;
                proxy_send_timeout         240;
                proxy_read_timeout         240;
        }
}

It worked for me.

0

If using ModSecurity v2.0 - v2.9, then in the .conf file you can use

SecServerSignature SomeName

ModSecurity v3 SecServerSignature has been deprecated, but I don't know if they replaced it with something else.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.