How to hide/disable http header

[NJohnson]

We have an on-prem 3CX (debian) V20 Update9 installation that I need to disable the nginx headers to pass PCI compliance scans. I found some information online to add "server_tokens off" to the ngnix.conf file, but when I go into that file, it's already there. I'll paste in a snip from that section of the ngnix.conf file so you can see. Perhaps that's not the right place for it, but like I said, it was already there. If anyone has any suggestions on what to do now, I would greatly appreciate it.

server {
listen 5001 ssl http2;
listen [::]:5001 ssl http2;
listen 5000;
listen [::]:5000;
server_name xxxx.xxxx.com;
server_tokens off;

 

[Charles_3CX]

Hi, if you issue the following form in a command prompt:

curl -I https://yourdomain.com

What do you see in the response to the server?

This should be

Server: nginx

Which means that the server Tokens are off

If they were on, then you should see more information regarding the Nginx version, for example, Server: nginx/1.26.1, which is not the case here.

 

[NJohnson]

It shows Server: nginx. The issue is the PCI scanning provider does not want that to show at all and fails scans due to the server type being visible. Is there a way to either completely remove the server from the header?

 

[paulodagraca]

Hello NJohnson,

You could try to use the more_clear_headers, like this:

server {
listen 5001 ssl http2;
listen [::]:5001 ssl http2;
listen 5000;
listen [::]:5000;
server_name xxxx.xxxx.com;

server_tokens off; # Hides version from error pages
more_clear_headers 'Server'; # Removes the 'Server' header entirely
}

Hope this works for you.
Please do test the configuration and restart the NGINX server:

sudo nginx -t
sudo systemctl reload nginx

Paulo

 

[paulodagraca]

Hello NJohnson,

Please do not try this above, as you will need to install some: libnginx-mod
Doing this, it did kill my nginx server to a point where i needed to re-install my test 3CX server.
So this is NOT without danger to f**k things up, be carefull.

Paulo

 

[Alphabetic]

Hello NJohnson,

Please do not try this above, as you will need to install some: libnginx-mod
Doing this, it did kill my nginx server to a point where i needed to re-install my test 3CX server.
So this is NOT without danger to f**k things up, be carefull.

Paulo

 

[NJohnson]

Yeah, I'm not going to do anything that could result in me having to reload our phone system and have 300+ upset employees after me. If it's not possible (without the possibility of breaking it) to remove "server: nginx" from the header, is it possible to change it to something bogus so it doesn't identify the server type? Perhaps something like "server: abc123".