Where can I set ServerTokens for ispconfig?

Discussion in 'Installation/Configuration' started by Telesat, Mar 6, 2007.

  1. Telesat

    Telesat ISPConfig Developer ISPConfig Developer

    I have set "ServerTokens ProductOnly" for apache2 in /etc/apache2/apache2.conf and it is working perfectly (only showing Apache).

    Then I have tried to set it also for ispconfig (httpd = apache1) but it is not working. I've tried to put it in the following files (with no result after restarting ispconfig_server):

    /root/ispconfig/httpd/conf/httpd.conf
    /root/ispconfig/httpd/conf/httpd.conf_http
    /root/ispconfig/httpd/conf/httpd.conf_https

    I have not tried to reboot the server, but I don't think that it would help. Does anyone know where to set such an important option for security?

    Thanks in advance.
     
    Last edited: Mar 7, 2007
  2. martinfst

    martinfst ISPConfig Developer ISPConfig Developer

    Security by Obscurity is no security at all. It helps a bit, but you should never rely on masquerading and think you're save.

    I've done it myself for the regular Apache2 server like you, but I never bothered to look at ISPconfig. It's either running on port 81 (default) or it's running https on port 80 (like I did on a separate IP on the same box). See the forum on how to do that.
     
  3. Telesat

    Telesat ISPConfig Developer ISPConfig Developer

    No one?

    Martin, I'm aware of it, AFAIK my servers are secure, but what about a zero-day exploit for 1.3.37? Give a 0-day to any script-kiddie and will try to find the affected servers by its signature: I don't feel like having it, and you? If you did it for your apache2, why didn't you bother about ispconfig?

    I have upgraded to ISPC 2.2.11 some hours ago. I discovered that the firewall in ISPC was bastille when I installed bastille. I have psad, port-knocking, logcheck, rkhunter, chkrootkit, perfect permissions, and some other security tools and I know exactly what they do, and how to use them. I also know how to change ports and IPs depending on the service in apache, or in any other program.

    You tell me to go to the forum and find... what? Isn't it a bad RTFM? Of course I've searched in the fora, have you found an answer to my question?
     
    Last edited: Mar 7, 2007
  4. martinfst

    martinfst ISPConfig Developer ISPConfig Developer

    There's no need to get upset. How should we be able to tell how much you know about security and how well (or not) you protected your servers? You write nothing about your background (no need to), but blaming me for probably a typo is not very nice. If you can't accept critical questions, you shouldn't be on the internet.

    Back to your original question, just for the sake of this thread, I added
    Code:
    ServerTokens ProductOnly
    to /root/ispconfig/httpd/conf/httpd.conf, and restarted ISPConfig:
    Code:
    /etc/init.d/ispconfig_server restart
    I added the ServerTokens line at line 288 (of a 2.2.9 install) after the (commented) ServerName directive. It's working as expected.
     
  5. Telesat

    Telesat ISPConfig Developer ISPConfig Developer

    Not working in 2.2.10, 2.2.11

    Hello Martin

    Thanks for your time and for the update, but it is not working in my servers: nor in old 2.2.10 neither in new 2.2.11.

    No typos here: before asking I had tried with
    Code:
    ServerTokens ProductOnly
    and with
    Code:
    ServerTokens Prod
    in the place you say and 800 lines later, inside
    Code:
    ##
    ## SSL Virtual Host Context
    ##
    
    <VirtualHost _default_:XY>
    I didn't get upset, see the smiley in the title of the answer :)cool: ). Of course I can accept critical questions, whenever they have some kind of base. Maybe my Junior status made you think I was a noob, that's good: I like to see how beginners are treated in each place.

    I think that everyone may be allowed on the Internet, with some minor exceptions: crackers, pirates, trolls, flamers, FUDers, pederasts, fascists, criminals, terrorists... ;)

    My tech background (not necessary, I know): Computer Science and Telecommunications Engineering (both are 5 year university degrees in my country). BTW security by obsolence is not security at all either :rolleyes:

    Did anyone manage to do it in the 2 more recent versions of ISPConfig? Should I fill a bug ticket? May I become an ISPC developper to fix this issue?
     
    Last edited: Mar 7, 2007
  6. falko

    falko Super Moderator ISPConfig Developer

  7. Telesat

    Telesat ISPConfig Developer ISPConfig Developer

    A good RTFM

    Sorry falko, I knew this info, but it is not working for me :(

    When I find the right place to put the ServerTokens, I'll come back and tell you.
     
  8. falko

    falko Super Moderator ISPConfig Developer

    I'm confused now. You want to change the ServerTokens for the ISPConfig server (port 81), not for the main Apache, right?

    Did you modify /root/ispconfig/httpd/conf/httpd.conf or another file?
     
  9. Telesat

    Telesat ISPConfig Developer ISPConfig Developer

    Me too

    Hi,

    I'm confused also, I modified the file /etc/apache2/apache2.conf and it worked like a charm: when I point http://SERVER_IP/er404 I get:

    Code:
    [B][SIZE="4"]Object not found![/SIZE][/B]
    The requested URL was not found on this server. If you entered the URL manually please check your spelling and try again. 
    If you think this is a server error, please contact the webmaster. 
    [B]Error 404[/B]
    SERVER_IP
    Fri Mar 9 15:15:51 2007
    [U]Apache[/U]
    Then I wanted to modify the configuration for ISPC, which originally uses https://domain.tld:81. My /root/ispconfig/httpd/conf/httpd.conf is the default file provided with ispconfig 2.2.11 (and 2.2.10). I tried modifying it, but when pointing at: https://SERVER_IP:81/er404 I get:

    Code:
    404 Not Found
    [B][SIZE="4"]Not Found[/SIZE][/B]
    The requested URL /er404 was not found on this server.
    [U]Apache/1.3.37 Server at SERVER_IP Port 81[/U]
    I tried to modify these files also, but it didn't help:
    - /root/ispconfig/httpd/conf/httpd.conf_http
    - /root/ispconfig/httpd/conf/httpd.conf_https

    Could you please confirm that it is working for you in ISPConfig 2.2.10 or 2.2.11?

    Thanks for your help
     
    Last edited: Mar 9, 2007
  10. martinfst

    martinfst ISPConfig Developer ISPConfig Developer

    After you modified /root/ispconfig/httpd/conf/httpd.conf, did you restart the ISPC webserver:
    Code:
    /etc/init.d/ispconfig_server restart
    ?
     
  11. Telesat

    Telesat ISPConfig Developer ISPConfig Developer

    Of course

    Of course, from the first post ( http://www.howtoforge.com/forums/showpost.php?p=63560&postcount=1 ):

    "... (with no result after restarting ispconfig_server):"

    In fact, what I've tried (lots of times) is to stop ispconfig_server and then start it.
    I do it that way because I had problems with an ancient version of apache (8 years ago), it didn't take the conf file into account when just restarting it.
     
    Last edited: Mar 9, 2007
  12. Telesat

    Telesat ISPConfig Developer ISPConfig Developer

    Thank you falfo (or Till) for the fourth change in 2.2.20, changelog here
     
  13. Telesat

    Telesat ISPConfig Developer ISPConfig Developer

    Ok, but now I feel safer, and I guess that you too

    Ok, but now I feel safer, and I guess that you too ;)

    See the fourth change in 2.2.20, changelog here.
     

Share This Page