Was playing around with conf files and found some options to increase the obscurity of the server.
In apache.conf setting these should set Apache to reveal minimum information about your system and webserver/version:
ServerSignature Off
ServerTokens production
You also may want to disable/comment the /manual/ and /icons/ directories that are setup for a default Apache install.
Setting this setting in the php.ini file will stop PHP from revealing itself to the browser:
expose_php = Off
Just a few settings that will help obfusicate yourself, of course this wont protect you against actual exploits; but it's a start.
And remember to validate/strip tags from all forms PHP sends to a database.
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment