Hiding Subversion version number

[Dhanushka Parakrama]

Hi All

Is there any configuration where i can hide the subversion version details
.Please see copied image [image: Inline images 1]

[Dave Huang]

Post by Dhanushka Parakrama
Hi All
Is there any configuration where i can hide the subversion version details .Please see copied image <image.png>

I think that's controlled by the Apache ServerSignature configuration option (https://httpd.apache.org/docs/2.4/mod/core.html#serversignature <https://httpd.apache.org/docs/2.4/mod/core.html#serversignature>)

[Nico Kadel-Garcia]

Why would you want to hide this?

Post by Dhanushka Parakrama
Hi All
Is there any configuration where i can hide the subversion version details
.Please see copied image <image.png>

[Matt Simmons]

Many documents relating to information security compliance require blocking
visible software version information.

Post by Nico Kadel-Garcia
Why would you want to hide this?

Post by Dhanushka Parakrama
Hi All
Is there any configuration where i can hide the subversion version

details

Post by Dhanushka Parakrama
.Please see copied image <image.png>

[Branko Čibej]

Post by Matt Simmons
Many documents relating to information security compliance require
blocking visible software version information.

Interesting documents. I'd have expected them to require all software to
be patched to fix all known security bugs. I thought the "security by
obscurity" mantra had been debunked, but apparently not ...

-- Brane

Post by Matt Simmons
Why would you want to hide this?

On Dec 15, 2017, at 9:15, Dhanushka Parakrama
Hi All
Is there any configuration where i can hide  the subversion

version details

.Please see copied image <image.png>

--
"Today, vegetables... Tomorrow, the world!" 

[Matt Simmons]

OT, but you can see one here:

http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-44ver2.pdf

(specifically, section 5.1: Reconfigure HTTP service banner (and others as
required) not to report Web server and OS type and version )

There are, of course, mandates to use up to date software, but, also many
other suggestions. Some practical, some just weird.

--Matt

Post by Branko Čibej

Post by Matt Simmons
Many documents relating to information security compliance require
blocking visible software version information.

Interesting documents. I'd have expected them to require all software to
be patched to fix all known security bugs. I thought the "security by
obscurity" mantra had been debunked, but apparently not ...
-- Brane

Post by Matt Simmons
Why would you want to hide this?

On Dec 15, 2017, at 9:15, Dhanushka Parakrama
Hi All
Is there any configuration where i can hide the subversion

version details

.Please see copied image <image.png>

--
"Today, vegetables... Tomorrow, the world!"

[Eric Johnson]

Hiding the version information is but a piece of the puzzle. It won’t save
a server from a persistent attacker. However, hiding the server software,
and the software version, makes it harder for “drive-by” attackers to
discover that your server is vulnerable. They don’t generally want to spend
the time to test the universe of known compromises to server software, but
if they know they only need to test for vulnerabilities to Subversion
1.7.X, then you’ve got their attention.

Hiding that information slows the drive-by attackers down, much like having
a safe will do the same. In some cases the extra time nudges attackers
towards looking for easier targets.

Eric

On Dec 16, 2017, at 3:35 AM, Branko Čibej <***@apache.org> wrote:

On 15.12.2017 20:10, Matt Simmons wrote:

Many documents relating to information security compliance require

blocking visible software version information.


Interesting documents. I'd have expected them to require all software to
be patched to fix all known security bugs. I thought the "security by
obscurity" mantra had been debunked, but apparently not ...

-- Brane

On Fri, Dec 15, 2017 at 10:46 AM Nico Kadel-Garcia <***@gmail.com

<mailto:***@gmail.com <***@gmail.com>>> wrote:


Why would you want to hide this?


On Fri, Dec 15, 2017 at 10:54 AM, Dave Huang <***@azeotrope.org

<mailto:***@azeotrope.org <***@azeotrope.org>>> wrote:

On Dec 15, 2017, at 9:15, Dhanushka Parakrama

<***@gmail.com <mailto:***@gmail.com
<***@gmail.com>>>

wrote:



Hi All


Is there any configuration where i can hide the subversion

version details

.Please see copied image <image.png>

[Daniel Shahaf]

Post by Eric Johnson
Hiding that information slows the drive-by attackers down,

Hiding that information is a pretty clear signal that "I think I'm an
interesting target", though. Everyone who's serious about security knows
that the right answer is to configure httpd to put an IIS banner in the
"Server:" header :°)

[Branko Čibej]

Post by Daniel Shahaf

Post by Eric Johnson
Hiding that information slows the drive-by attackers down,

Hiding that information is a pretty clear signal that "I think I'm an
interesting target", though. Everyone who's serious about security knows
that the right answer is to configure httpd to put an IIS banner in the
"Server:" header :°)

ROFL! If I were an attacker, that'd definitely put me off my lunch. :)

[Branko Čibej]

Post by Dhanushka Parakrama
Hi All
Is there any configuration where i can hide  the subversion version
details .Please see copied image Inline images 1

You could start by telling us *where* you see that image. In a browser,
I presume? Generated by which server? It's certainly not generated by
Subversion so I wonder if you're on the right list?

-- Brane

[Dave Huang]

Post by Branko Čibej

Post by Dhanushka Parakrama
Hi All
Is there any configuration where i can hide  the subversion version
details .Please see copied image Inline images 1

You could start by telling us *where* you see that image. In a browser,
I presume? Generated by which server? It's certainly not generated by
Subversion so I wonder if you're on the right list?
-- Brane

Of course it's generated by Subversion. mod_dav_svn, to be more precise.
Just Google for "Powered by Apache Subversion" to find tons of examples,
e.g., https://svn.openstreetmap.org/

See also:
http://svn.apache.org/viewvc/subversion/trunk/subversion/mod_dav_svn/repos.c?view=markup#l3547

[Matt Simmons]

This sounds like the ServerSignature directive

https://httpd.apache.org/docs/2.4/mod/core.html#serversignature

Have you turned it off?

On Fri, Dec 15, 2017 at 7:15 AM, Dhanushka Parakrama <

Post by Dhanushka Parakrama
Hi All
Is there any configuration where i can hide the subversion version
details .Please see copied image [image: Inline images 1]