fbpx

NGINX / Security / Server Setup

How to remove the Server header in NGINX

by , , revisited on


We have by far the largest RPM repository with NGINX module packages and VMODs for Varnish. If you want to install NGINX, Varnish, and lots of useful performance/security software with smooth yum upgrades for production use, this is the repository for you.
Active subscription is required.

Security through obscurity isn’t the holy grail that will make your website secure completely. But it doesn’t mean you shouldn’t use it. As a complementary security measure, it must be used.

NGINX, by default, sends information about its use in the Server HTTP header as well as error pages, e.g.: nginx/1.16.1.

To confirm the currently emitted header, you may run in your terminal:

curl -IsL https://example.com/ | grep -i server

Hide version information

The standard security solution you might be already using in these regards is hiding NGINX version information. In your nginx.conf:

http {
   ...
   server_tokens off;
   ...
}

This only hides the specific version of NGINX from the Server header and error pages.
The header becomes:

Server: nginx

However, it’s much better to remove the Server header completely.

Hide the Server header

You can easily achieve this by using third-party modules.

Using ngx_security_headers module

Using our RPM repository for NGINX (requires subscription), it’s easy to install the module with:

sudo yum -y install https://extras.getpagespeed.com/release-latest.rpm
sudo yum -y install nginx-module-security-headers

Now you can adjust your nginx.conf like this:

load_module modules/ngx_http_security_headers_module.so;

http {
    ...
    hide_server_tokens on;
    ...
}

As a result, the Server header is completely eliminated from the responses.

Using Headers More module

Using our RPM repository for NGINX (requires subscription), this module is easy to install with:

sudo yum -y install https://extras.getpagespeed.com/release-latest.rpm
sudo yum -y install nginx-module-headers-more

Now you can adjust your nginx.conf like this:

load_module modules/ngx_http_headers_more_filter_module.so;

http {
    ...
    more_clear_headers Server;
    ...
}

Likewise, the Server header will be completely gone from the responses.

Bonus tip: Hide the use of NGINX altogether

Hiding the Server header is good, but you might notice that the default error pages by NGINX still output the “nginx” word in them.

An easy way to complete hiding of NGINX presence on the server is using NGINX-MOD.
Simply specify the following in the configuration:

server_tokens none;

Only NGINX-MOD supports none value for server_tokens directive.

Alternatively, you can hide the NGINX presence by recompiling it from the source (highly discouraged, see common pitfalls).

You need to adjust NGINX sources to prevent the information disclosure of NGINX software.

sed -i 's@"nginx/"@"-/"@g' src/core/nginx.h
sed -i 's@r->headers_out.server == NULL@0@g' src/http/ngx_http_header_filter_module.c
sed -i 's@r->headers_out.server == NULL@0@g' src/http/v2/ngx_http_v2_filter_module.c
sed -i 's@<hr><center>nginx</center>@@g' src/http/ngx_http_special_response.c

Then recompile NGINX.

Citrus Stack server users already have a secure NGINX version, which doesn’t need this.

  1. dzam

    I am not a server admin and do not have access to nginx.conf, can something similar be done in php.ini?

    Reply
  2. Bragi Austfjörð

    Can I use this for plesk centos 8

    Reply
    • Danila Vershinin

      I think every article here can’t be updated to account for Plesk (mostly the instructions are for panel-less setups),
      but Plesk modules deserve their dedicated page, which I have set up here.

      From there I hope it will be clear how to install/enable NGINX modules for Plesk, for example:

      sudo yum -y install sw-nginx-module-security-headers
      sudo plesk sbin nginx_modules_ctl --enable security-headers 
      

      Essentially for every tutorial on the website about NGINX modules, prefix NGINX module package name with sw- (that gives you the name of Plesk-compatible NGINX module package), and use the Plesk way of enabling the module instead of adding load_module ... to nginx.conf.

      Note that not every NGINX module from the base repository is available for Plesk, but most are.

      Reply
      • Bragi Austfjörð

        Thanks for your reply. I really appreciate that. Yeah I agree not all blog post can work for plesk hehe but I had to ask 🙂

        Reply
      • bragiaustfjordBragi Austfjörð

        I tried and I have this error.

        Problem: problem with installed package sw-nginx-compat-1.18.0.2-1.el8.gps.x86_64
          - package sw-nginx-compat-1.18.0.2-1.el8.gps.x86_64 requires sw-nginx = 1.18.0.2, but none of the providers can be installed
          - package sw-nginx-module-security-headers-1:1.18.0.0.0.9-3.el8.pl18.gps.x86_64 requires sw-nginx = 1.18.0, but none of the providers can be installed
          - cannot install both sw-nginx-1.18.0.2-2.centos.8+p18.0.32.0+t201202.1945.x86_64 and sw-nginx-1.18.0-2.centos.8+p18.0.29.0+t200720.1125.x86_64
          - cannot install both sw-nginx-1.18.0.2-2.centos.8+p18.0.32.0+t201202.1945.x86_64 and sw-nginx-1.18.0-2.centos.8+p18.0.29.1+t200807.1333.x86_64
          - cannot install both sw-nginx-1.18.0.2-2.centos.8+p18.0.32.0+t201202.1945.x86_64 and sw-nginx-1.18.0-2.centos.8+p18.0.29.2+t200817.1747.x86_64
          - cannot install both sw-nginx-1.18.0.2-2.centos.8+p18.0.32.0+t201202.1945.x86_64 and sw-nginx-1.18.0-2.centos.8+p18.0.29.3+t200825.2156.x86_64
          - cannot install both sw-nginx-1.18.0.2-2.centos.8+p18.0.32.0+t201202.1945.x86_64 and sw-nginx-1.18.0-2.centos.8+p18.0.30.0+t200826.0942.x86_64
          - cannot install the best candidate for the job
          - cannot install both sw-nginx-1.18.0.2-2.centos.8+p18.0.32.1+t201211.1937.x86_64 and sw-nginx-1.18.0-2.centos.8+p18.0.29.0+t200720.1125.x86_64
          - cannot install both sw-nginx-1.18.0.2-2.centos.8+p18.0.32.1+t201211.1937.x86_64 and sw-nginx-1.18.0-2.centos.8+p18.0.29.1+t200807.1333.x86_64
          - cannot install both sw-nginx-1.18.0.2-2.centos.8+p18.0.32.1+t201211.1937.x86_64 and sw-nginx-1.18.0-2.centos.8+p18.0.29.2+t200817.1747.x86_64
          - cannot install both sw-nginx-1.18.0.2-2.centos.8+p18.0.32.1+t201211.1937.x86_64 and sw-nginx-1.18.0-2.centos.8+p18.0.29.3+t200825.2156.x86_64
          - cannot install both sw-nginx-1.18.0.2-2.centos.8+p18.0.32.1+t201211.1937.x86_64 and sw-nginx-1.18.0-2.centos.8+p18.0.30.0+t200826.0942.x86_64
          - cannot install both sw-nginx-1.18.0.2-2.centos.8+p18.0.32.2+t201217.1925.x86_64 and sw-nginx-1.18.0-2.centos.8+p18.0.29.0+t200720.1125.x86_64
          - cannot install both sw-nginx-1.18.0.2-2.centos.8+p18.0.32.2+t201217.1925.x86_64 and sw-nginx-1.18.0-2.centos.8+p18.0.29.1+t200807.1333.x86_64
          - cannot install both sw-nginx-1.18.0.2-2.centos.8+p18.0.32.2+t201217.1925.x86_64 and sw-nginx-1.18.0-2.centos.8+p18.0.29.2+t200817.1747.x86_64
          - cannot install both sw-nginx-1.18.0.2-2.centos.8+p18.0.32.2+t201217.1925.x86_64 and sw-nginx-1.18.0-2.centos.8+p18.0.29.3+t200825.2156.x86_64
          - cannot install both sw-nginx-1.18.0.2-2.centos.8+p18.0.32.2+t201217.1925.x86_64 and sw-nginx-1.18.0-2.centos.8+p18.0.30.0+t200826.0942.x86_64
          - cannot install both sw-nginx-1.18.0-2.centos.8+p18.0.29.0+t200720.1125.x86_64 and sw-nginx-1.18.0.2-2.centos.8+p18.0.32.2+t201217.1925.x86_64
          - cannot install both sw-nginx-1.18.0-2.centos.8+p18.0.29.1+t200807.1333.x86_64 and sw-nginx-1.18.0.2-2.centos.8+p18.0.32.2+t201217.1925.x86_64
          - cannot install both sw-nginx-1.18.0-2.centos.8+p18.0.29.2+t200817.1747.x86_64 and sw-nginx-1.18.0.2-2.centos.8+p18.0.32.2+t201217.1925.x86_64
          - cannot install both sw-nginx-1.18.0-2.centos.8+p18.0.29.3+t200825.2156.x86_64 and sw-nginx-1.18.0.2-2.centos.8+p18.0.32.2+t201217.1925.x86_64
          - cannot install both sw-nginx-1.18.0-2.centos.8+p18.0.30.0+t200826.0942.x86_64 and sw-nginx-1.18.0.2-2.centos.8+p18.0.32.2+t201217.1925.x86_64
        (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages or '--nobest' to use not only best candidate packages)
        
        Reply
  3. Anonymous

    Hi Danila,

    I tried to run:
    sudo yum -y install nginx-module-security-headers
    or
    sudo yum -y install nginx-module-headers-more

    but both resulted to:
    No package nginx-module-security-headers available.
    No package nginx-module-headers-more available.

    respectively. I’m using RHEL 7, do I have to install before this?

    Thanks.

    Reply
    • Danila Vershinin

      For packaged installation, you need to be an active commercial subscriber, and follow-through repository setup, which is essentially:

      sudo yum -y install https://extras.getpagespeed.com/release-latest.rpm
      
      Reply

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: