Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

IIS and server banner info

Posted on 2013-12-10
3
Medium Priority
?
310 Views
Last Modified: 2014-01-21
How do you disable the server type banner on an http request?  Right now ours is publsihing server:  MicrosoftIIS/7.5.  If it can be disabled, can it be disabled without messing up exchange?
0
Comment
Question by:bnussbaum
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39709292
Why do you want to do that? You don't get security by obscurity.
If you are running Exchange on the server then it will take an attacker about 5 seconds to realise what server you are running.

Simon.
0
 

Author Comment

by:bnussbaum
ID: 39709393
We hire a 3rd party audit comany to audit our systems, and they have flagged this as a medium vulnerability.  They said to use urlscan tool to obscure the header info, but it appears that with IIS 8, that tool can't be used.  I was hoping there was an easy way to just disable it.
0
 
LVL 63

Accepted Solution

by:
Simon Butler (Sembee) earned 1500 total points
ID: 39709654
Third party audit companies working to a predefined scripts are nothing but a pain in...

The fact that they have said to use URLSCAN means that
a. They are using old information
b. They have no clue what they are on about, because as you said URLSCAN cannot be used with the later versions of Windows.

Medium Vulnerability. That is a joke.

I do a lot of high risk deployments with high risk financial services clients, this has never been requested. As I already said, hiding something doesn't provide any additional security and in most cases just breaks functionality.

Simon.
0

Featured Post

Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I don't pretend to be an expert at this, but I have found a few things that are useful. I hope that sharing them here will help others, so they will not have to face some rather hard choices. Since I felt this to be a topic of enough importance and…
One-stop solution for Exchange Administrators to address all MS Exchange Server issues, which is known by the name of Stellar Exchange Toolkit.
In this Micro Video tutorial you will learn the basics about Database Availability Groups and How to configure one using a live Exchange Server Environment. The video tutorial explains the basics of the Exchange server Database Availability grou…
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question