By default, Nginx displays the version number, such as:
[root@bkjz ~]# curl -I www.nginx.org
HTTP/1.1 200 OK
Server: nginx/0.8.44
Date: Tue, 13 Jul 2010 14:05:11 GMT
Content-Type: textml
Content-Length: 8284
Last-Modified: Tue, 13 Jul 2010 12:00:13 GMT
Connection: keep-alive
Keep-Alive: timeout=15
Accept-Ranges: bytes
This shows that your server nginx version is 0.8.44, and some Nginx version vulnerabilities have been exposed some time ago, that is, some versions have vulnerabilities and some versions do not. In this way, the exposed version number can easily become information that attackers can exploit. Therefore, from a security point of view, hiding the version number will be relatively safer!
1. Add server_tokens off to the nginx configuration file;
server_tokens scope is http server locatio to remove the n statement block
server_tokens default value is on, which means that the version information is displayed, and the server_tokens value is off, you can hide the version information of nginx everywhere.
2. If the fastcgi_param SERVER_SOFTWARE is set in the php configuration file, find this line and modify it:
Edit the php-fpm configuration file, such as fastcgi.conf or fcgi.conf (this configuration file name can also be customized, depending on the specific file name):
Found it:
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
Changed to:
fastcgi_param SERVER_SOFTWARE nginx;
3. Restart nginx to reload the configuration file and finish
|
Posted on 6/16/2015 11:16:37 PM
|
|
|
|
Landlord|
Posted on 6/16/2015 11:42:56 PM
|
Posted on 1/15/2016 2:32:11 PM
|
