From issues-return-27761-archive-asf-public=cust-asf.ponee.io@activemq.apache.org Tue Apr 24 18:26:05 2018 Return-Path: X-Original-To: archive-asf-public@cust-asf.ponee.io Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by mx-eu-01.ponee.io (Postfix) with SMTP id 0C8B6180679 for ; Tue, 24 Apr 2018 18:26:04 +0200 (CEST) Received: (qmail 24679 invoked by uid 500); 24 Apr 2018 16:26:04 -0000 Mailing-List: contact issues-help@activemq.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@activemq.apache.org Delivered-To: mailing list issues@activemq.apache.org Received: (qmail 24670 invoked by uid 99); 24 Apr 2018 16:26:04 -0000 Received: from pnap-us-west-generic-nat.apache.org (HELO spamd4-us-west.apache.org) (209.188.14.142) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 24 Apr 2018 16:26:04 +0000 Received: from localhost (localhost [127.0.0.1]) by spamd4-us-west.apache.org (ASF Mail Server at spamd4-us-west.apache.org) with ESMTP id B3886C02CF for ; Tue, 24 Apr 2018 16:26:03 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at spamd4-us-west.apache.org X-Spam-Flag: NO X-Spam-Score: -110.31 X-Spam-Level: X-Spam-Status: No, score=-110.31 tagged_above=-999 required=6.31 tests=[ENV_AND_HDR_SPF_MATCH=-0.5, KAM_SHORT=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, USER_IN_DEF_SPF_WL=-7.5, USER_IN_WHITELIST=-100] autolearn=disabled Received: from mx1-lw-eu.apache.org ([10.40.0.8]) by localhost (spamd4-us-west.apache.org [10.40.0.11]) (amavisd-new, port 10024) with ESMTP id uKjwzRCGnYQD for ; Tue, 24 Apr 2018 16:26:02 +0000 (UTC) Received: from mailrelay1-us-west.apache.org (mailrelay1-us-west.apache.org [209.188.14.139]) by mx1-lw-eu.apache.org (ASF Mail Server at mx1-lw-eu.apache.org) with ESMTP id 961CC5FAD2 for ; Tue, 24 Apr 2018 16:26:01 +0000 (UTC) Received: from jira-lw-us.apache.org (unknown [207.244.88.139]) by mailrelay1-us-west.apache.org (ASF Mail Server at mailrelay1-us-west.apache.org) with ESMTP id AAE4EE00C6 for ; Tue, 24 Apr 2018 16:26:00 +0000 (UTC) Received: from jira-lw-us.apache.org (localhost [127.0.0.1]) by jira-lw-us.apache.org (ASF Mail Server at jira-lw-us.apache.org) with ESMTP id 6FAAA241C7 for ; Tue, 24 Apr 2018 16:26:00 +0000 (UTC) Date: Tue, 24 Apr 2018 16:26:00 +0000 (UTC) From: "Robbie Gemmell (JIRA)" To: issues@activemq.apache.org Message-ID: In-Reply-To: References: Subject: [jira] [Commented] (AMQ-6952) CLONE - Hide embedded jetty version MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394 [ https://issues.apache.org/jira/browse/AMQ-6952?page=3Dcom.atlassian.j= ira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=3D164501= 56#comment-16450156 ]=20 Robbie Gemmell commented on AMQ-6952: ------------------------------------- For later reference, you can 'move' JIRAs between projects rather than manu= ally recreate on the other project. > CLONE - Hide embedded jetty version > ----------------------------------- > > Key: AMQ-6952 > URL: https://issues.apache.org/jira/browse/AMQ-6952 > Project: ActiveMQ > Issue Type: New Feature > Reporter: Justin Bertram > Priority: Major > > Hi, > sorry in advance if this is something easy for jetty experts.=C2=A0We nee= d some guidance or see if hiding the embedded jetty configuration is possib= le. > We have not seen anywhere in the documentation how to hide the embedded j= etty version. This is marked as a security thread by our penetration tester= s when we are using a web sockets transport on port 80. We have been playin= g around with the configuration file jetty.xml and the parameters, but no s= uccess. It has been addressed for other projects (see=C2=A0https://issues.a= pache.org/jira/browse/HADOOP-13414) > =C2=A0So far we have been trying to change the configuration in jetty.xml= . > As far as we know, this should be the configuration for the property: > {code:java} > > > > > {code} > However, this has no effect in the exposing of the version. We=C2=A0tried= further and tried with a connection factory, but this also had no effect: > {code:java} > > > > > > > > > > > > > > > > > > > > > > {code} > Are we on the right track, or does it need to be addressed by the codebas= e of ActiveMQ?=C2=A0 > This is how we show the version: > {code:java} > #nmap -sV -p80 localhost > Starting Nmap 7.70 ( https://nmap.org ) at 2018-04-23 18:16 CEST > Nmap scan report for localhost (127.0.0.1) > Host is up (0.000098s latency). > PORT STATE SERVICE VERSION > 80/tcp open http Jetty 9.2.22.v20170606 > Service detection performed. Please report any incorrect results at https= ://nmap.org/submit/ . > Nmap done: 1 IP address (1 host up) scanned in 11.34 seconds > {code} -- This message was sent by Atlassian JIRA (v7.6.3#76005)