From patchwork Fri Jun 18 07:07:21 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Peter_M=C3=BCller?= X-Patchwork-Id: 4439 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4G5qkC0RZwz3x7Q for ; Fri, 18 Jun 2021 07:07:31 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4G5qk947S2z13Q; Fri, 18 Jun 2021 07:07:29 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4G5qk92RwTz2yRf; Fri, 18 Jun 2021 07:07:29 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4G5qk81B4pz2xYh for ; Fri, 18 Jun 2021 07:07:28 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4G5qk70yPmzZH for ; Fri, 18 Jun 2021 07:07:26 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1624000047; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ezBr+804/dkudo/8McQlBGCi9266dc2r+g8Scboj4hQ=; b=BgwyDmhXultxXgNiU4oXklBsJWlXLyK8dzbGsFTjRTdsCozRz/FNTt/bHnhYzSuu845J+d vk5VLv6zq57jTICw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1624000047; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ezBr+804/dkudo/8McQlBGCi9266dc2r+g8Scboj4hQ=; b=Z5DQhMBb5QFUtljH8zYwRL72sQOfys7Xi4eCx3yugeCt+0fLJ6/cOnMb8JaPxbNDVEOoNd RXhPum1sX8A68hSVppm78aDVSw+XkadyXtSw21NG2rKLikTi1idFY8EazS7ryyDJAIgLB4 JYPwJ3Pf8yMFNwUok4xPqpb3XKMwzWcZIiks0J98j7628hI1CKaZJipAZPof1ncMCfLBy+ cOlKnOlkrPP/p2dfd6M3nGKUe2silmvX95o9Bx8R26MUUm12MyGqVr8ysE7+nSjk3ZiDuk QpRhHKc2EmzAFuNC23HG396w0zO6rCcy5ywyN4llAcWsurYnP9Risw2WFp8LUA== To: "IPFire: Development" From: =?utf-8?q?Peter_M=C3=BCller?= Subject: [PATCH] proxy.cgi: Suppress Squid version by default Message-ID: <009b2fc7-361a-dacb-ff33-75144d9b2a52@ipfire.org> Date: Fri, 18 Jun 2021 09:07:21 +0200 MIME-Version: 1.0 Content-Language: en-US X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" While hiding version information does not come with any _actual_ security improvements, it is generally a good thing to do so by default: Attackers will still be able to reasonably guess or enumerate the software version running, but need to conduct additional effort to do so, hence more likely raising alerts and drawing attention on their operation. In addition, we suppress version details somewhere else in IPFire 2.x by default, too (e. g. Unbound and Apache), so we can justify this patch by aiming to stay consistent, I guess. :-) Signed-off-by: Peter Müller --- html/cgi-bin/proxy.cgi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/cgi-bin/proxy.cgi b/html/cgi-bin/proxy.cgi index 78ad33ad2..1b949d5b6 100644 --- a/html/cgi-bin/proxy.cgi +++ b/html/cgi-bin/proxy.cgi @@ -188,7 +188,7 @@ $proxysettings{'ADMIN_MAIL_ADDRESS'} = ''; $proxysettings{'ADMIN_PASSWORD'} = ''; $proxysettings{'ERR_LANGUAGE'} = 'en'; $proxysettings{'ERR_DESIGN'} = 'ipfire'; -$proxysettings{'SUPPRESS_VERSION'} = 'off'; +$proxysettings{'SUPPRESS_VERSION'} = 'on'; $proxysettings{'FORWARD_VIA'} = 'off'; $proxysettings{'FORWARD_IPADDRESS'} = 'off'; $proxysettings{'FORWARD_USERNAME'} = 'off';