One of the things which gives a potential attacker some help is them knowing which versions of software you use. This can be very easy to find out, particularly if you have never taken steps to secure this information.

For example: I would like to know what software apache.org are using/have used so I look at netcraft (for example) http://toolbar.netcraft.com/site_report?url=http://www.apache.org

192.87.106.226 Linux Apache/2.2.3 Unix mod_ssl/2.2.3 OpenSSL/0.9.7g 12-Apr-2007

I now know that I should look for exploits relating to linux, apache v2.2.3, mod_ssl 2.2.3 and OpenSSL0.9.7g.

By hiding this information you can either report simply “unknown” or just “apache” and no other info. This doesn’t directly make your box more secure, what it does do is start to make the task more difficult for a would-be attacker and for such a small amount of effort it really does seem silly not to do it. So how?

The first thing is to set the ServerTokens directive. I am using a RH linux box so if you know your OS differs, find the corresponding location of your httpd.conf:

vi or pico /etc/httpd/conf/httpd.conf

Find the line(s) containing ServerTokens and ServerSignature

ServerTokens has the following options (I used Prod):

ProductOnly     Server: Apache
Major     Server: Apache/2
Minor     Server: Apache/2.2
Minimal     Server: Apache/2.2.3
OS     Server: Apache/2.2.3 (RedHat)
Full (or not specified) default     Server: Apache/2.2.34 (RedHat) mod_ssl/2.2.3 OpenSSL/0.9.7g
The syntax is as follows:

ServerTokens ProductOnly
ServerSignature Off

Close the config file and restart apache (service apache restart OR /etc/init.d/httpd restart)

Courtesy: hungerfordwebdesign.com
Other Links: http://www.ducea.com/2006/06/08/apache-tips-tricks/