Disable server_tokens directive in NGINX

[JJediny]

Draft CIS Benchmark 1.1.10

Description

By default NGINX will happily tell a user what version of NGINX is in use. This is valuable information to an attacker, and should be turned off by making use of the server\_tokens directive.

Rationale

Potential attackers may check if your version of NGINX contains known vulnerabilities. Hiding the version will slow down and mitigate potential attackers.

Remediation

To disable the server\_tokens directive, set if to off inside a server block in your nginx.conf: server { ... server_tokens off; ... }

Audit

In the NGINX configuration file nginx.conf ensure the server\_tokens directive is set to off. You can also check a 404 page provided by NGINX and see if it displays a version number.