Skip to main content

How to Disable Apache Version Number Disclosure on FileWave Server

What

FileWave Server can expose Apache version details in its HTTP response headers by default. This article shows how to reduce that disclosure so the server reports only Apache instead of the full component and version string.

When/Why

Use this when your organization requires a less detailed Apache banner. It reduces the version information sent in HTTP responses, but does not patch Apache, remove vulnerabilities, or replace FileWave security updates and access controls. Apache explains this distinction in its ServerTokens documentation.

Date: Fri, 14 Jul 2023 00:05:55 GMT
Server: Apache/2.4.57 (Unix) OpenSSL/3.0.9 mod_wsgi/4.9.4 Python/3.10
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Frame-Options: SAMEORIGIN
Content-Length: 362

The example above is a historical response showing the component versions included in a detailed Apache banner. Hiding those values does not change the installed components or establish that the server is secure.

How

Self-managed Servers only: have the authorized server administrator make this change. If FileWave hosts your Server, contact FileWave Technical Support using the link below instead of following the SSH and file-editing steps.

Keep a recoverable copy of the current configuration and arrange the Apache restart with the server owner because it interrupts web requests. Review any existing ServerTokens and ServerSignature settings before adding the lines below. Run service-control commands with the administrative privileges described in How to Restart FileWave Components.

  1. SSH into your FileWave server. If you are unsure how to do this, contact FileWave Technical Support.
  2. Open /usr/local/filewave/apache/conf/httpd_custom.conf in a text editor, for example:
sudo vi /usr/local/filewave/apache/conf/httpd_custom.conf
  1. Add these lines to the file:
ServerTokens Prod
ServerSignature Off
  1. Save the file.
  2. Restart Apache:
fwcontrol apache restart

After the restart, inspect the response headers from your FileWave Server again. ServerTokens Prod should reduce the Server header to Apache; ServerSignature Off suppresses the footer on Apache-generated pages. The historical response below illustrates the shorter header. Its 400 Bad Request status is not a successful service-health check. Confirm that normal FileWave web access still works separately.

HTTP/1.1 400 Bad Request
Date: Fri, 14 Jul 2023 00:11:38 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Frame-Options: SAMEORIGIN
Content-Length: 362

No comments to display