*** Description of problem: Satellite installation process does not set these two settings in Apache, which reduce information leakage potential: ServerTokens Prod ServerSignature Off Satellite documentation contains no mention of setting these. These need to be set on both Satellite server and Capsule. *** Version-Release number of selected component (if applicable): Satellite 6.1.8 *** How reproducible: Always *** Steps to Reproduce: 1. Install Satellite 6.1.8 with separate Capsule 2. Check Apache configuration on the Satellite server and on the Capsule: grep -r 'Server\(Tokens\|Signature\)' /etc/httpd/conf* *** Actual results: /etc/httpd/conf/httpd.conf:ServerTokens OS /etc/httpd/conf/httpd.conf:ServerSignature On /etc/httpd/conf.d/03-crane.conf: ServerSignature Off /etc/httpd/conf.d/05-foreman.conf: ServerSignature Off /etc/httpd/conf.d/15-default.conf: ServerSignature Off /etc/httpd/conf.d/25-puppet.conf: ServerSignature Off /etc/httpd/conf.d/05-foreman-ssl.conf: ServerSignature Off *** Expected results: /etc/httpd/conf/httpd.conf:ServerTokens OS /etc/httpd/conf/httpd.conf:ServerSignature On /etc/httpd/conf.d/03-crane.conf: ServerTokens Prod /etc/httpd/conf.d/03-crane.conf: ServerSignature Off /etc/httpd/conf.d/05-foreman.conf: ServerTokens Prod /etc/httpd/conf.d/05-foreman.conf: ServerSignature Off /etc/httpd/conf.d/15-default.conf: ServerTokens Prod /etc/httpd/conf.d/15-default.conf: ServerSignature Off /etc/httpd/conf.d/25-puppet.conf: ServerTokens Prod /etc/httpd/conf.d/25-puppet.conf: ServerSignature Off /etc/httpd/conf.d/05-foreman-ssl.conf: ServerTokens Prod /etc/httpd/conf.d/05-foreman-ssl.conf: ServerSignature Off *** Additional info:
Moving 6.2 bugs out to sat-backlog.
*** This bug has been marked as a duplicate of bug 1305782 ***