I've got some security through obscurity questions - not directly related to
PHP programming per se, but indirectly related, as most php programmers are
also server admins of their servers.
I want to restrict what my box reports back to the likes of scanners like
Nmap & Nessus.
I know how to get PHP to not report its version number, and the same with
Apache.
My question is
a) how to I prevent MySQL from reporting its version number?
b) My Apache now reports itself as just "Apache" - can I fake that, and just
get it to report as ,say, "MyWebServer"
c) Is it possible to get MySQL to report back as say "Oracle"?
d) What about PHP - can I fake the reporting of it to say "Tomcat version 2"
or something? 1 2019
kaptain kernel <no****@nospam.gov> writes: I've got some security through obscurity questions - not directly related to PHP programming per se, but indirectly related, as most php programmers are also server admins of their servers. I want to restrict what my box reports back to the likes of scanners like Nmap & Nessus.
The use of security through obscurity is an old debate. I could
argue both sides, but I'll simply suggest that you do some research
to make sure you understand what obscurity provides and what it
doesn't provide.
I know how to get PHP to not report its version number, and the same with Apache.
My question is
a) how to I prevent MySQL from reporting its version number?
You'll probably have to hack the source. But do you really need
to do this? You should have a firewall allowing only authorized
sources to connect to your MySQL server, and legitimate users might
need to know what version you're running (so they can look up what
features it supports, what known limitations or bugs it might have,
etc.).
I don't know about earlier versions of MySQL, but with 4.0.16 even
hosts that can make a TCP connection to the MySQL server won't see
a version number unless they're authorized to connect by the MySQL
authorization system:
Connection from an authorized host:
% telnet db.example.com 3306
Trying 10.1.2.3...
Connected to db.example.com.
Escape character is '^]'.
+
4.0.16-log...
Connect from an unauthorized host:
% telnet db.example.com 3306
Trying 10.1.2.3...
Connected to db.example.com.
Escape character is '^]'.
GHost 'unauthorized.example.com' is not allowed to connect to this MySQL server
Connection closed by foreign host.
b) My Apache now reports itself as just "Apache" - can I fake that, and just get it to report as ,say, "MyWebServer"
c) Is it possible to get MySQL to report back as say "Oracle"?
You should be able to change the "Host...is not allowed to connect
to this MySQL server" message by editing the appropriate language's
errmsg.txt file and regenerating errmsg.sys; see the MySQL manual
for more information. If you're that insistent on obscurity, then
make sure you configure MySQL to listen on a port other than the
default (3306).
To remove all possible references to MySQL you might have to hack
the source, but make sure you don't break anything in the client-server
protocol. As I asked above, do you really need to do this, since
only authorized users should have access to this information anyway?
d) What about PHP - can I fake the reporting of it to say "Tomcat version 2" or something?
You said you already knew how to tell PHP not to expose iself and
how to make Apache say it's something else, so you could just put
"Tomcat" in Apache's lie. Where else would you want to "fake the
reporting"?
--
Michael Fuhr http://www.fuhr.org/~mfuhr/ This thread has been closed and replies have been disabled. Please start a new discussion. Similar topics
by: Chung Leong |
last post by:
Building web sites with PHP is easy. Building secured web sites--in any
language--is hard. The end result is many PHP sites with security issues. I
thought therefore it would be a good idea to put...
|
by: Tim Tyler |
last post by:
Here's what this morning's security advisory read here:
``In the last 3 months we have noticed an marked increase in the number of
web-server attacks and successful compromise on our network....
|
by: Rod Carrol |
last post by:
Hello all,
As a beginner I've been exeperiencing lots of errors while building my
website, (I'm currently attempting to implement a member
login/registration piece for my site using mySQL and...
|
by: Inz Akure |
last post by:
Why not spoof your machine so it appears to be a linux box or ?? You could
maybe run a linux based proxy, switch your ASP extensions to PHP through
IIS, create custom error pages to appear to be...
|
by: guitarromantic |
last post by:
Hey everyone.
I'm just finishing up writing a basic content management system,
standard stuff really, just pulling info out of a database and allowing
priveliged users to login and post it. I...
|
by: raykyoto |
last post by:
Hi all,
I'm sure this is a popular question that comes up every few months
here. Indeed, I've looked at some of the past postings, but I would
like to ask things differently.
Basically, I'm...
|
by: Mike MacSween |
last post by:
S**t for brains strikes again!
Why did I do that? When I met the clients and at some point they vaguely
asked whether eventually would it be possible to have some people who could
read the data...
|
by: Rama Sharma |
last post by:
One can disassemble the code of an assembly (in say Visual C# language)
complied by using Visual Studio .NET even if it is a Release build. This can
be done by using the disassembler "ILDASM.EXE"...
|
by: zuhans |
last post by:
hello,
i'm very new to postgres and have a fundamental question.
how do i make a pg-db most secure?
i feel, that pg_user e.g. ist something very dangerous - isn't it? if
someone hacks into a...
|
by: emmanuelkatto |
last post by:
Hi All, I am Emmanuel katto from Uganda. I want to ask what challenges you've faced while migrating a website to cloud.
Please let me know.
Thanks!
Emmanuel
|
by: BarryA |
last post by:
What are the essential steps and strategies outlined in the Data Structures and Algorithms (DSA) roadmap for aspiring data scientists? How can individuals effectively utilize this roadmap to progress...
|
by: Sonnysonu |
last post by:
This is the data of csv file
1 2 3
1 2 3
1 2 3
1 2 3
2 3
2 3
3
the lengths should be different i have to store the data by column-wise with in the specific length.
suppose the i have to...
|
by: Hystou |
last post by:
There are some requirements for setting up RAID:
1. The motherboard and BIOS support RAID configuration.
2. The motherboard has 2 or more available SATA protocol SSD/HDD slots (including MSATA, M.2...
|
by: marktang |
last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However,...
|
by: Oralloy |
last post by:
Hello folks,
I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>".
The problem is that using the GNU compilers,...
|
by: tracyyun |
last post by:
Dear forum friends,
With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each...
|
by: agi2029 |
last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing,...
|
by: isladogs |
last post by:
The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM).
In this session, we are pleased to welcome a new...
| |