For political reasons, the customer will refuse to have any non-IIS web
servers. Since we deliver the service as SaaS, the customer can only see
the
OS fingerprint and server signature (together with a few other things
like
error pages).
For the OS signature we are able to change it on the fly with a
security/network appliance and make it looks unknown, but we now need to
fake the web server signature. Rather than adding a proxy such as
varnish in
front, I am looking for the way to directly patch the source code to
change
the server signature.
Could someone point me the file name to patch to get this done?
As for curious, I work behind the scene so the end-user does not know my
name
For the OS signature we are able to change it on the fly with a
security/network appliance and make it looks unknown, but we now need
to fake the web server signature. Rather than adding a proxy such as
varnish in front, I am looking for the way to directly patch the
source code to change the server signature.
Could someone point me the file name to patch to get this done?
You can edit the server name values by changing ‘ngx_http_server_string’
and ‘ngx_http_server_full_string’ in
src/http/ngx_http_header_filter_module.c. Note the NGINX_VER is set in
nginx.h
For the OS signature we are able to change it on the fly with a
security/network appliance and make it looks unknown, but we now
need to fake the web server signature. Rather than adding a proxy
such as varnish in front, I am looking for the way to directly patch
the source code to change the server signature.
You can either do that or use this 3rd party module:
security/network appliance and make it looks unknown, but we now need to
fake the web server signature. Rather than adding a proxy such as varnish
in front, I am looking for the way to directly patch the source code to
change the server signature.
Could someone point me the file name to patch to get this done?
As for curious, I work behind the scene so the end-user does not know my
name
Not sure what that last bit is supposed to mean but I hope you realize
that
you can get into big trouble contractually if you misrepresent the
service
to your customer. This might not sound like a big deal from a technical
perspective but if anything goes wrong than you can basically be accused
of
fraud quite easily.
All is under control - we are first just going to do a PoC to the
customer
for about a 3 days and have results measured/benchmarked with Gomez and
then
when they will see the result, the price and all, they will likely
approve
the best option.
Not the first time we deal so with them and that we do surprise them in
good.
