Solved

IIS and server banner info

Posted on 2013-12-10
3
309 Views
Last Modified: 2014-01-21
How do you disable the server type banner on an http request?  Right now ours is publsihing server:  MicrosoftIIS/7.5.  If it can be disabled, can it be disabled without messing up exchange?
0
Comment
Question by:bnussbaum
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39709292
Why do you want to do that? You don't get security by obscurity.
If you are running Exchange on the server then it will take an attacker about 5 seconds to realise what server you are running.

Simon.
0
 

Author Comment

by:bnussbaum
ID: 39709393
We hire a 3rd party audit comany to audit our systems, and they have flagged this as a medium vulnerability.  They said to use urlscan tool to obscure the header info, but it appears that with IIS 8, that tool can't be used.  I was hoping there was an easy way to just disable it.
0
 
LVL 63

Accepted Solution

by:
Simon Butler (Sembee) earned 500 total points
ID: 39709654
Third party audit companies working to a predefined scripts are nothing but a pain in...

The fact that they have said to use URLSCAN means that
a. They are using old information
b. They have no clue what they are on about, because as you said URLSCAN cannot be used with the later versions of Windows.

Medium Vulnerability. That is a joke.

I do a lot of high risk deployments with high risk financial services clients, this has never been requested. As I already said, hiding something doesn't provide any additional security and in most cases just breaks functionality.

Simon.
0

Featured Post

Get 15 Days FREE Full-Featured Trial

Benefit from a mission critical IT monitoring with Monitis Premium or get it FREE for your entry level monitoring needs.
-Over 200,000 users
-More than 300,000 websites monitored
-Used in 197 countries
-Recommended by 98% of users

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A list of top three free exchange EDB viewers that helps the user to extract a mailbox from an unmounted .edb file and get a clear preview of all emails & other items with just a single click on mailboxes.
A couple of months ago we ran into an issue that necessitated re-creating our Edge Subscriptions. However, when we attempted to execute the command: New-EdgeSubscription -filename C:\NewEdgeSub_01.xml we received an error indicating that the LDAP se…
how to add IIS SMTP to handle application/Scanner relays into office 365.
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…

623 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question