Am 12.08.2012 14:23, schrieb Michael Meyer: > *** Reindl Harald wrote: > >> and as long not nessus nor openvas can say which webserver i >> run my work to prevent any type of fingerprinting was well done > > Let me guess...you are running http://trafficserver.apache.org/ at > thelounge.net. ;) > > Micha
you won this time :-) but the trafficserver is up since a month and openVAS refuses to work since Fedora 16, so i had only 4 monthly OpenVAS-Scans from december 2011 until it refsued to work and yes, looking at the time i spent to get it running proper i am "a little bit " pissed of this fact :-) ____________________________ however, as said obscurity is one piece of a security-concept it will not help you alone, but it can help you in timeframes of a zero-day-exploit and a lot of automated not so deep scans compared with spitting installation-details with every request there is no 100% security there is no 100% obscurity a good security concept has many pieces on OS, applications, firewalls, IDS, obscurity and helps to minimze the danger if ONE automated scan checking your http-response header for the Server and you are telling the scanner your exact patchlevels it may be the one hit to kill you with a zeroö-day-exploit while the attacker may no try other things and 30 minutes later you roll out the update
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Openvas-discuss mailing list [email protected] http://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
