documentation_complete: true

prodtype: rhel7

title: 'Set httpd <tt>ServerTokens</tt> Directive to <tt>Prod</tt>'

description: |-
    <tt>ServerTokens Prod</tt> restricts information in page headers, returning only the word "Apache."
    <br /><br />
    Add or correct the following directive in <tt>/etc/httpd/conf/httpd.conf</tt>:
    <pre>ServerTokens Prod</pre>

rationale: |-
    Information disclosed to clients about the configuration of the web server and system could be used
    to plan an attack on the given system. This information disclosure should be restricted to a minimum.

severity: unknown

identifiers:
    cce@rhel7: 80302-3

references:
    nist: CM-7
