documentation_complete: true

title: 'Set httpd <tt>ServerSignature</tt> Directive to <tt>Off</tt>'

description: |-
    <tt>ServerSignature Off</tt> restricts <tt>httpd</tt> from displaying server version number
    on error pages.
    <br /><br />
    Add or correct the following directive in <tt>/etc/httpd/conf/httpd.conf</tt>:
    <pre>ServerSignature Off</pre>

rationale: |-
    Information disclosed to clients about the configuration of the web server and system could be used
    to plan an attack on the given system. This information disclosure should be restricted to a minimum.

severity: unknown

identifiers:
    cce: 27586-7

references:
    nist: CM-7
