On a recent penetration test of a clients site the following was found, they are a web security firm and indicated that it would be better to hide this information.

Currently Barracuda's php.ini has:
expose_php = On
Recommended setting:
expose_php = Off

Comments

omega8cc’s picture

omega8cc commented

We don't expose PHP at all, not just PHP version, but not at all, so I don't really understand this suggestion. It would make sense for Apache with mod_php, but not for BOA. Where do you see PHP version used exposed publicly? Only site admin can see it in the status page etc and it is a good thing. Besides, it is childishly easy to determine if the site is powered by Drupal even if we would have fake headers all over the place, and it is rather obvious that Drupal runs on PHP, so?

realityloop’s picture

realityloop commented

examples:

http://realityloop.com/index.php?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000
http://realityloop.com/index.php?=PHPE9568F36-D428-11d2-A769-00AA001ACF42

omega8cc’s picture

omega8cc commented

As I said, what non-generic, non-specific information is provided that way, besides obvious fact that Drupal is a PHP app?

realityloop’s picture

realityloop commented

The logo changes every version so it is possible to infer the php version from this.

http://stackoverflow.com/questions/4123558/turning-off-random-php-gif-logo

omega8cc’s picture

omega8cc commented

Interesting! Thanks. I think we will rather deny these requests instead of disabling expose_php, to not break the PHP status page (it would remove the image also there etc). Do you think it should fix the problem?

realityloop’s picture

realityloop commented

Sounds perfectly acceptable to me.

It looks like there are actually 4 of them that should potentially be blocked:
http://www.0php.com/php_easter_egg.php

The 1st answer here has regex for htaccess that may help with nginx:
http://stackoverflow.com/questions/10458610/how-can-i-disable-phps-easte...

omega8cc’s picture

omega8cc commented
Status: Active » Fixed

Committed in http://drupalcode.org/project/barracuda.git/commit/2dd75bd

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.