Additional security measures
This section outlines additional security measures to enhance the security of your Swarm installation.
Hide your Apache version and Linux OS
Verbose user interfaces and banner-grabbing applications show system information to users looking for version-specific vulnerabilities in your server environment. The system information can be used for various purposes, such as marketing and competitor analysis. Hiding your OS and Apache version adds a degree of difficulty for potential cyber attackers.
View server HTTP headers
There are many ways to view a server's HTTP headers. The easiest option is to use an online tool such as Security Headers or Mozilla Observatory.
If you’re on a Linux system, you can use the curl or wget terminal commands:
curl --head yourdomain.com
wget --server-response --spider yourdomain.com
If you are logged into the Linux system that you want to modify, use localhost in the following commands:
curl --head localhost
wget --server-response --spider localhost
Within the header information you will see a line that states the web server software and version you are using alongside your server OS.
For example: Server: Apache/2.4.10 (Debian)
Hide Apache Version and OS
To remove your Apache version and OS from HTTP headers and server-generated pages, do the following:
-
Log into SSH (Secure Shell protocol) as root.
-
Edit your Apache server configuration file using a text editor.
CentOS/AlmaLinux:
nano /etc/httpd/conf/httpd.conf
Debian/Ubuntu:
nano /etc/apache2/conf-enabled/security.conf
-
Scroll down to the “ServerTokens” section where you will probably see multiple lines commented out (beginning with “#”) stating “ServerTokens” and different options. Change the uncommented line, likely “ServerTokens OS”, or comment out the line and create a new line to hide the Apache version and OS from HTTP headers: ServerTokens Prod
If you do not see the “ServerTokens” and “ServerSignature” sections, add the necessary lines to the bottom of your configuration file.
-
The next section down should be the “ServerSignature” section. Turning this off hides the information from server-generated pages. For example, Internal Server Error.
ServerSignature Off
-
Save the changes and close the file.
-
Restart Apache server as follows:
CentOS/AlmaLinux:
systemctl restart httpd
Debian /Ubuntu:
systemctl restart apache2
-
Recheck your server HTTP headers:
curl --head localhost