Search code examples
apacheodooreverse-proxyodoo-13

How to hide odoo server information with httpd as reverse proxy

I installed odoo on centos 8 and use httpd as a reverse proxy. Like other Apache hardening, I use ServerTokens Proddan ServerSignature Off to hide server information.

but when I try wget the results still show server information

Spider mode enabled. Check if remote file exists.
--2020-03-12 11:57:14--  http://my.domain/
Resolving my.domain (my.domain)... 169.0.0.1
Connecting to my.domain (my.domain)|169.0.0.1|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 301 Moved Permanently
  Content-length: 0
  Location: https://my.domain/
Location: https://my.domain/ [following]
Spider mode enabled. Check if remote file exists.
--2020-03-12 11:57:14--  https://my.domain/
Connecting to my.domain (my.domain)|169.0.0.1|:443... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Thu, 12 Mar 2020 04:56:55 GMT
  Server: Werkzeug/0.14.1 Python/3.7.5
  Content-Type: text/html; charset=utf-8
  Content-Length: 10589
  Set-Cookie: frontend_lang=en_US; Path=/
  Set-Cookie: session_id=s8487a5ec76bd455f42680c38195b5f7f0285d563; Expires=Wed, 10-Jun-2020 04:56:55 GMT; Max-Age=7776000; HttpOnly; Path=/
  Vary: User-Agent
Length: 10589 (10K) [text/html]
Remote file exists and could contain further links,
but recursion is disabled -- not retrieving.
Solution

  • well it can use mod_header and mod_rewrite, then add

    add Header set Server "value that you want" to your apache virtual host