4507-nginx-servertoken - Ensure the server_tokens directive is set to off¶

Rule ID¶

• 4507-nginx-servertoken

Category¶

• nginx

Level¶

• info

Supported Versions¶

• Linux

Description¶

• The server_tokens directive controls whether NGINX version and operating system version are displayed in error pages and the Server HTTP response header field. This information should not be disclosed.

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• Attackers can use these response headers to perform reconnaissance on the website and then launch targeted attacks against specific known vulnerabilities in the underlying technology. Hiding the version slows down and blocks some potential attackers.

Risk Item¶

• nginx security

Audit Method¶

• Execute the following command to verify:

curl -I 127.0.0.1 | grep -i server
# If the result is as shown below, it is recommended to disable server_token
Server: nginx/1.14.0

Remediation¶

• Execute the following command: To disable the server_tokens directive, set it to off inside the server block in nginx.conf:

server {
 ...
 server_tokens off;
 ...
}

Impact¶

• None

Default Value¶

• By default, the default value of server_tokens is on.

References¶

• None

CIS Controls¶

• None