Nginx no longer leaks version and OS information.
Nginx no longer leaks version and OS information.

If you run the following curl command:

    curl -i -H "Host: <myhost>" http://<myhost>

In the response that is returned the Server header contains details of the
nginx version number and operating system:

    HTTP/1.1 301 Moved Permanently
    Server: nginx/1.10.3 (Ubuntu)
    Date: Thu, 12 Jul 2018 17:14:21 GMT

This information is useful to an attacker and should not be leaked.

The server_tokens directive was added to the two server blocks in the nginx
configuration file so the version number nad host operating system is removed:

    HTTP/1.1 301 Moved Permanently
    Server: nginx
    Date: Thu, 12 Jul 2018 17:14:21 GMT

It would be nice to also remove the name of the web server but that's hard-wired
in the nginx source code and you would have to manually compile it to remove it.

DavidCain/mitoc-ansible,DavidCain/mitoc-ansible,DavidCain/mitoc-ansible