473,388 Members | 1,256 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,388 software developers and data experts.

security through obscurity

I've got some security through obscurity questions - not directly related to
PHP programming per se, but indirectly related, as most php programmers are
also server admins of their servers.
I want to restrict what my box reports back to the likes of scanners like
Nmap & Nessus.

I know how to get PHP to not report its version number, and the same with
Apache.

My question is

a) how to I prevent MySQL from reporting its version number?

b) My Apache now reports itself as just "Apache" - can I fake that, and just
get it to report as ,say, "MyWebServer"

c) Is it possible to get MySQL to report back as say "Oracle"?

d) What about PHP - can I fake the reporting of it to say "Tomcat version 2"
or something?


Jul 17 '05 #1
1 2018
kaptain kernel <no****@nospam.gov> writes:
I've got some security through obscurity questions - not directly related to
PHP programming per se, but indirectly related, as most php programmers are
also server admins of their servers.
I want to restrict what my box reports back to the likes of scanners like
Nmap & Nessus.
The use of security through obscurity is an old debate. I could
argue both sides, but I'll simply suggest that you do some research
to make sure you understand what obscurity provides and what it
doesn't provide.
I know how to get PHP to not report its version number, and the same with
Apache.

My question is

a) how to I prevent MySQL from reporting its version number?
You'll probably have to hack the source. But do you really need
to do this? You should have a firewall allowing only authorized
sources to connect to your MySQL server, and legitimate users might
need to know what version you're running (so they can look up what
features it supports, what known limitations or bugs it might have,
etc.).

I don't know about earlier versions of MySQL, but with 4.0.16 even
hosts that can make a TCP connection to the MySQL server won't see
a version number unless they're authorized to connect by the MySQL
authorization system:

Connection from an authorized host:

% telnet db.example.com 3306
Trying 10.1.2.3...
Connected to db.example.com.
Escape character is '^]'.
+
4.0.16-log...

Connect from an unauthorized host:

% telnet db.example.com 3306
Trying 10.1.2.3...
Connected to db.example.com.
Escape character is '^]'.
GHost 'unauthorized.example.com' is not allowed to connect to this MySQL server
Connection closed by foreign host.
b) My Apache now reports itself as just "Apache" - can I fake that, and just
get it to report as ,say, "MyWebServer"

c) Is it possible to get MySQL to report back as say "Oracle"?
You should be able to change the "Host...is not allowed to connect
to this MySQL server" message by editing the appropriate language's
errmsg.txt file and regenerating errmsg.sys; see the MySQL manual
for more information. If you're that insistent on obscurity, then
make sure you configure MySQL to listen on a port other than the
default (3306).

To remove all possible references to MySQL you might have to hack
the source, but make sure you don't break anything in the client-server
protocol. As I asked above, do you really need to do this, since
only authorized users should have access to this information anyway?
d) What about PHP - can I fake the reporting of it to say "Tomcat version 2"
or something?


You said you already knew how to tell PHP not to expose iself and
how to make Apache say it's something else, so you could just put
"Tomcat" in Apache's lie. Where else would you want to "fake the
reporting"?

--
Michael Fuhr
http://www.fuhr.org/~mfuhr/
Jul 17 '05 #2

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

32
by: Chung Leong | last post by:
Building web sites with PHP is easy. Building secured web sites--in any language--is hard. The end result is many PHP sites with security issues. I thought therefore it would be a good idea to put...
38
by: Tim Tyler | last post by:
Here's what this morning's security advisory read here: ``In the last 3 months we have noticed an marked increase in the number of web-server attacks and successful compromise on our network....
16
by: Rod Carrol | last post by:
Hello all, As a beginner I've been exeperiencing lots of errors while building my website, (I'm currently attempting to implement a member login/registration piece for my site using mySQL and...
4
by: Inz Akure | last post by:
Why not spoof your machine so it appears to be a linux box or ?? You could maybe run a linux based proxy, switch your ASP extensions to PHP through IIS, create custom error pages to appear to be...
6
by: guitarromantic | last post by:
Hey everyone. I'm just finishing up writing a basic content management system, standard stuff really, just pulling info out of a database and allowing priveliged users to login and post it. I...
13
by: raykyoto | last post by:
Hi all, I'm sure this is a popular question that comes up every few months here. Indeed, I've looked at some of the past postings, but I would like to ask things differently. Basically, I'm...
116
by: Mike MacSween | last post by:
S**t for brains strikes again! Why did I do that? When I met the clients and at some point they vaguely asked whether eventually would it be possible to have some people who could read the data...
2
by: Rama Sharma | last post by:
One can disassemble the code of an assembly (in say Visual C# language) complied by using Visual Studio .NET even if it is a Release build. This can be done by using the disassembler "ILDASM.EXE"...
2
by: zuhans | last post by:
hello, i'm very new to postgres and have a fundamental question. how do i make a pg-db most secure? i feel, that pg_user e.g. ist something very dangerous - isn't it? if someone hacks into a...
0
by: taylorcarr | last post by:
A Canon printer is a smart device known for being advanced, efficient, and reliable. It is designed for home, office, and hybrid workspace use and can also be used for a variety of purposes. However,...
0
by: ryjfgjl | last post by:
If we have dozens or hundreds of excel to import into the database, if we use the excel import function provided by database editors such as navicat, it will be extremely tedious and time-consuming...
0
by: ryjfgjl | last post by:
In our work, we often receive Excel tables with data in the same format. If we want to analyze these data, it can be difficult to analyze them because the data is spread across multiple Excel files...
1
by: nemocccc | last post by:
hello, everyone, I want to develop a software for my android phone for daily needs, any suggestions?
1
by: Sonnysonu | last post by:
This is the data of csv file 1 2 3 1 2 3 1 2 3 1 2 3 2 3 2 3 3 the lengths should be different i have to store the data by column-wise with in the specific length. suppose the i have to...
0
by: Hystou | last post by:
There are some requirements for setting up RAID: 1. The motherboard and BIOS support RAID configuration. 2. The motherboard has 2 or more available SATA protocol SSD/HDD slots (including MSATA, M.2...
0
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers,...
0
jinu1996
by: jinu1996 | last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven...
0
by: Hystou | last post by:
Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.