Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

How can I mask IIS7 server information without using ServerMask

Posted on 2014-12-23
4
Medium Priority
?
210 Views
Last Modified: 2014-12-24
I have a windows 2008 server running IIS7. I would like to mask the server information from hackers and I am familiair with a tool called ServerMask: http://www.port80software.com/products/servermask/

I would like to know if server masking can be achieved natively by just using IIS7.
0
Comment
Question by:mike99c
  • 2
4 Comments
 
LVL 39

Expert Comment

by:Aaron Tomosky
ID: 40515932
I use this in my default web.config
<system.webServer>
    <httpProtocol>
        <customHeaders>
            <remove name="X-Powered-By" />
        </customHeaders>
    </httpProtocol>
</system.webServer>
0
 
LVL 33

Expert Comment

by:shalomc
ID: 40516056
I can fully understand when someone does not want to install additional software on sensitive servers, because of regulations, security or compliance.

In those cases I use a reverse proxy in front of the web server. There are commercial solutions like aiscaler, and open source solutions like Varnish, and CDN services like Fastly or Akamai.
A CDN service like those mentioned has the additional benefit of accelerating your entire application, but it is relevant only if the web site is public.
0
 

Author Comment

by:mike99c
ID: 40516113
Thanks Aaron.

When I analyse my header information I also found the following which would give away the fact that I have a windows server:

Server      Microsoft-IIS/7.5      This web server is running Microsoft-IIS/7.5

Set-Cookie      ASPSESSIONIDQCRQBTQA=AKGLKIHACFFCKPBFFEBFLOOE; path=/      The web site is trying to set a cookie (per RFC2109), with the following information: ASPSESSIONIDQCRQBTQA=AKGLKIHACFFCKPBFFEBFLOOE; path=/

I tried modifying web.config as follows:

            <customHeaders>
                <remove name="X-Powered-By" />
                <remove name="Server" />
                <remove name="Set-Cookie" />
            </customHeaders>

Unfortunately it did not remove Server and Set-Cookie.
0
 
LVL 39

Accepted Solution

by:
Aaron Tomosky earned 2000 total points
ID: 40516661
0

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Understanding the various editions available is vital when you decide to purchase Windows Server 2012. You need to have a basic understanding of the features and limitations in each edition in order to make a well-informed decision that best suits …
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…

572 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question