Change Nginx Server Name in Header on Ubuntu Server

Abhishek Ghosh

By Abhishek Ghosh April 19, 2015 3:37 am Updated on April 19, 2015

Change Nginx Server Name in Header on Ubuntu Server

Declaring the Server Name is a Security Risk, You Can Change the Server Name From Nginx to Apache2 or What You Want. It is Easier on Ubuntu. For non-deb Linux distort, the only way to change is to compile from the source, which is pathetically bad and big work for many running instances. Debian/Ubuntu has some advantages. If you are using apt for OS X, you can use this trick to change Nginx server name. You can directly go to the Change Nginx Server Name in Header on Ubuntu Server With HttpHeadersMoreModule sub header if you are using Ubuntu. This conventional way is kept as legacy method.

Traditional Way to Change Nginx Server Name in Header on Ubuntu Server

If we run curl -I for our website, we will get this :

âžœ  ~  curl -I https://thecustomizewindows.com
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 19 Apr 2015 02:58:32 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.5.9-1ubuntu4.7
Set-Cookie: PHPSESSID=57riuklgncj2ej0n936r2tq2g1; path=/
Expires: Sat, 13 Feb 2016 02:58:32 GMT
Cache-Control: max-age=25920000
Pragma: no-cache
X-Pingback: https://thecustomizewindows.com/xmlrpc.php
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Public-Key-Pins: pin-sha256="cTvjlwJ90gznKckrq+Le+9w5ncyKFwzLJOkgMBNoX2M="; max-age=5184000; includeSubDomains
Cache-Control: Public
Alternate-Protocol: 443:npn-spdy/3
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

âžœ ~ curl -I https://thecustomizewindows.com

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 19 Apr 2015 02:58:32 GMT

Content-Type: text/html; charset=UTF-8

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.5.9-1ubuntu4.7

Set-Cookie: PHPSESSID=57riuklgncj2ej0n936r2tq2g1; path=/

Expires: Sat, 13 Feb 2016 02:58:32 GMT

Cache-Control: max-age=25920000

Pragma: no-cache

X-Pingback: https://thecustomizewindows.com/xmlrpc.php

X-Frame-Options: SAMEORIGIN

X-Content-Type-Options: nosniff

X-XSS-Protection: 1; mode=block

Public-Key-Pins: pin-sha256="cTvjlwJ90gznKckrq+Le+9w5ncyKFwzLJOkgMBNoX2M="; max-age=5184000; includeSubDomains

Cache-Control: Public

Alternate-Protocol: 443:npn-spdy/3

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

We are talking about the third line – Server: nginx. X-Powered-By: PHP/5.5.9-1ubuntu4.7 is coming from PHP. This also shroud be changed, which is PHP related matter. Removing the version is very easy. You need to add :

server_tokens off;

1	server_tokens off;

in etc/nginx/nginx.conf file. For changing at compilation level, if you are building nginx kept at /src/nginx/, cd and open this file with nano :

cd /src/nginx/
nano src/http/ngx_http_header_filter_module.c

1 2	cd /src/nginx/ nano src/http/ngx_http_header_filter_module.c

Find these two lines :

static char ngx_http_server_string[] = "Server: nginx" CRLF;
static char ngx_http_server_full_string[] = "Server: " NGINX_VER CRLF;

1 2	static char ngx_http_server_string[] = "Server: nginx" CRLF; static char ngx_http_server_full_string[] = "Server: " NGINX_VER CRLF;

That nginx and NGINX_VER has to be changed.

Change Nginx Server Name in Header on Ubuntu Server With HttpHeadersMoreModule

HttpHeadersMoreModule gives the way to use this directive :

# set the Server output header
    more_set_headers 'Server: Apache2';
# set and clear output headers
    location /bar {
        more_set_headers 'X-MyHeader: blah' 'X-MyHeader2: foo';
        more_set_headers -t 'text/plain text/css' 'Content-Type: text/foo';
        more_set_headers -s '400 404 500 503' -s 413 'Foo: Bar';
        more_clear_headers 'Content-Type';
    }

1

2

3

4

5

6

7

8

9

# set the Server output header

more_set_headers 'Server: Apache2';

# set and clear output headers

location /bar {

more_set_headers 'X-MyHeader: blah' 'X-MyHeader2: foo';

more_set_headers -t 'text/plain text/css' 'Content-Type: text/foo';

more_set_headers -s '400 404 500 503' -s 413 'Foo: Bar';

more_clear_headers 'Content-Type';

}

In official websites you will get lot of examples. We are talking about using only more_set_headers 'Server: Apache2'; part. Others are additional usage. nginx is available in three flavors – nginx-light, nginx-full, nginx-extras. The others are – nginx-core, nginx-naxsi etc. When we use apt-get install nginx, the medium thing is installed. If we use apt-get install nginx nginx-extras command, we will get this module without compilation. In deb wiki, you’ll get more details :

https://wiki.debian.org/Nginx # copy the url to plain text editor first

1	https://wiki.debian.org/Nginx # copy the url to plain text editor first

Do not run the apt-get install nginx nginx-extras command, without taking backup of the /etc/nginx/nginx.conf and config file your site, usually this – /etc/nginx/sites-available/default. If you are using OpenStack, then you can take a snapshot and work with the kind of dev instance. For HTTPS sites, actually you’ll have to work a lot only for adding the things. There is no informative info when we run the apt-get install nginx command, this creates the problem. Otherwise almost all would use the extras version, frankly; this is the right stuff for most commonly used setups.

Tagged With nginx change server name , server_name header , ngx header server , nginx server name , change name nginx , nginx add servername to header , mofify server header nginx , change NGINX server name , change nginx headername , X-Frame-Options

About Abhishek Ghosh

Here’s what we’ve got for you which might like :

Take The Conversation Further ...

Get new posts by email: