Apache httpd deflector shields

Today I deceided to research which HTTP status codes are supported by the Apache httpd server, browsing around the source code repository [1] I found the http_protocol.c file which describes the implemented http status codes in the daemon.

As part of my good practices I have developed an ErrorDocument template that I call "Deflector Shield" which returns a 302 status instead of 404, 403 or the awful 500. According to the official documentation [2], the directive goes as follows:

ErrorDocument <StatusCode> <Document>
Where
  <StatusCode> is one of the implemented in the source code [1]
  <Document> is an error message or the path to a resource (either local or remote)

All this works for status codes other than 401 (Authorization Required) which require the message to be either the hardcoded or a custom string.

The custom error document directives are here [3]
[1] http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/modules/http/http_protocol.c
[2] http://httpd.apache.org/docs/2.2/mod/core.html#errordocument
[3] https://gist.github.com/4015668/

--
  = ^ . ^ =

Keep the robots out

Keep the robots out of your website

% cat $DocumentRoot/robots.txt

User-agent: *

Disallow: /

--

= ^ . ^ =

Apache httpd identification strings

The problem...

$ curl --verbose --user-agent "= ^ . ^ =" "http://localhost:80/info.php" > /dev/null

* About to connect() to localhost port 80 (#0)

* Trying 127.0.0.1... connected

* Connected to localhost (127.0.0.1) port 80 (#0)

> GET /info.php HTTP/1.1

> User-Agent: = ^ . ^ =

> Host: localhost

> Accept: */*

>

< HTTP/1.1 200 OK

< Date: Thu, 19 Jan 2012 23:59:59 GMT

< Server: Apache/2.2.16 (Debian) PHP/5.3.3-7+squeeze3 with Suhosin-Patch mod_ssl/2.2.16 OpenSSL/0.9.8o

< X-Powered-By: PHP/5.3.3-7+squeeze3

< Vary: Accept-Encoding

< Transfer-Encoding: chunked

< Content-Type: text/html

<

{ [data not shown]

* Connection #0 to host localhost left intact

* Closing connection #0

The solution...

/etc/apache2/conf.d/security

• ServerTokens Prod
• ServerSignature Off

/etc/php5/apache2/php.ini

• expose_php = Off

/etc/init.d/apache2 restart

$ curl --verbose --user-agent "= ^ . ^ =" "http://localhost:80/info.php" > /dev/null

* About to connect() to localhost port 80 (#0)

* Trying 127.0.0.1... connected

* Connected to localhost (127.0.0.1) port 80 (#0)

> GET /info.php HTTP/1.1

> User-Agent: = ^ . ^ =

> Host: localhost

> Accept: */*

>

< HTTP/1.1 200 OK

< Date: Thu, 20 Jan 2012 00:00:00 GMT

< Server: Apache

< Vary: Accept-Encoding

< Transfer-Encoding: chunked

< Content-Type: text/html

<

{ [data not shown]

* Connection #0 to host localhost left intact

* Closing connection #0

# rm -v /var/www/info.php

--

= ^ . ^ =