This post will guide How to install and configure Nginx Headers More Filter Module and completely remove Nginx server header.
For security reason, some times we need to remove all off server header on Nginx.
But default Nginx configuration from Nginx is only remove Nginx version.
server_tokens off;When we user server token off, example header is below:
# curl -s -I -H 'Accept-Encoding: br,gzip,deflate' https://serverdiary.com
HTTP/2 200
server: nginx
date: Sun, 08 Nov 2020 12:51:03 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
expires: Thu, 19 Nov 1981 08:52:00 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=15768000
content-encoding: brIf we want to completely remove server header, we can use Nginx Headers More Filter Module.
This Nginx module allows you to add, set, or clear any output or input header that you specify.
Also Read: How to install and configure Nginx ModSecurity on Centos 7
This is an enhanced version of the standard headers module because it provides more utilities like resetting or clearing “builtin headers” like Content-Type, Content-Length, and Server.
It also allows you to specify an optional HTTP status code criteria using the -s option and an optional content type criteria using the -t option while modifying the output headers with the more_set_headers and more_clear_headers directives.
Starting from NGINX 1.9.11, we can also compile this module as a dynamic module, by using the --add-dynamic-module=PATH option.
You can read more about this project on https://github.com/openresty/headers-more-nginx-module
How to install Nginx Headers More Filter Module
# yum groupinstall 'Development Tools' -y
# yum install gcc-c++ flex bison yajl yajl-devel curl-devel curl GeoIP-devel doxygen zlib-devel pcre-devel
# yum install lmdb lmdb-devel libxml2 libxml2-devel ssdeep ssdeep-devel lua lua-develClone repository ngx_http_headers_more_filter_module from Github
# cd /usr/src
# git clone https://github.com/openresty/headers-more-nginx-module.gitIn this post, we use lates stable Nginx version 1.18.0. We can check Nginx version with command:
# nginx -V
nginx version: nginx/1.18.0
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-39) (GCC)
built with OpenSSL 1.0.2k-fips 26 Jan 2017
TLS SNI support enabled
configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-compat --with-file-aio --with-threads --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-mail --with-mail_ssl_module --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -fPIC' --with-ld-opt='-Wl,-z,relro -Wl,-z,now -pie'Now we need to download Nginx source, depend on our Nginx version.
In this example is Nginx 1.16.1, compile module and compiled Nginx Brotli located in objs.
# cd /usr/src
# wget http://nginx.org/download/nginx-1.18.0.tar.gz
# tar zxvf nginx-1.18.0.tar.gz
# cd nginx-1.18.0
# ./configure --with-compat --add-dynamic-module=/usr/src/headers-more-nginx-module
# make modules
# cp objs/ngx_http_headers_more_filter_module.so /etc/nginx/modules
# chmod 644 /etc/nginx/modules/ngx_http_headers_more_filter_module.soHow To Completely Remove Nginx Server Header
To load Nginx Headers More Filter Module, edit /etc/nginx/nginx.conf and add this code in top of configuration.
Pingback: Nginx Monitoring using Nginx Module VTS - SERVERDIARY
You really make it appear so easy along with your presentation but I find this matter to be really something that I think I would by no means understand. It seems too complicated and very vast for me. I am looking forward for your next put up, I’ll try to get the hold of it!