securing vps[2]: secure php version information

Knowing the version of php is big advantage for a hacker. He or she can use the unpatched hole to attack the web server. Try this (see the bold words):

daniel-adinugrohos-computer:~ adinugro$ telnet xxxx.vpsfarm.com 80
Trying 209.9.228.xxx...
Connected to xxxx.vpsfarm.com.
Escape character is '^]'.
GET / HTTP/1.1 [type enter twice here]

[the output will be:]
HTTP/1.1 400 Bad Request
Date: Fri, 22 Jun 2007 23:05:06 GMT
Server: Apache/2.2.3 (Debian) PHP/5.2.0-8+etch4
Content-Length: 335
Connection: close
Content-Type: text/html; charset=iso-8859-1


In order to secure this, we must edit the php setting in php.ini. Do this:

debian:~# cd /etc/php5/apache2/
debian:/etc/php5/apache2# ls
conf.d php.ini
debian:/etc/php5/apache2# vi php.ini


# remove X-Powered-By
expose_php = Off [in line 260]

# also turn of the error information, it is the best practice for production server.
display_errors= Off [in line 323]

# don't forget to restart the web server:
debian:~# /etc/init.d/apache2 restart
Forcing reload of web server (apache2)....
debian:~#


Now, try again the testing:

daniel-adinugrohos-computer:~ adinugro$ telnet xxxx.vpsfarm.com 80
Trying 209.9.228.xxx...
Connected to xxxx.vpsfarm.com.
Escape character is '^]'.
GET / HTTP/1.1 [type enter twice here]

HTTP/1.1 400 Bad Request
Date: Fri, 22 Jun 2007 23:51:10 GMT
Server: Apache/2.2.3 (Debian)
Connection: close
Content-Type: text/html; charset=iso-8859-1

Connection closed by foreign host.
daniel-adinugrohos-computer:~ adinugro$


See the differences! It is not finish yet as the apache version is still shown. Next post will be how to turn off that!