I have a centos 7 server with apache v2.4.6 php 5.4.16 and OpenSSL 1.0.1e-fips installed. I was just doing a scan to it to see how secure my server is. I found out that my server is giving out information about what versions of apache, ssl and php I have, which I don't like it that much. Is there any way to configure my server to avoid giving this information?
How can I configure my server to avoid information leakage from the SERVER header of its HTTP response
security;apache httpd;php;openssl
This is, at least in part, governed by the ServerTokens directive, so you could set ServerTokens Prodwhich will reveal only that the Server is an unspecified version of Apache, but even the manual itself suggests this is not a security measure.