Configuring Your Server for IE 8

Originally posted on Web Pro World.

Microsoft Internet Explorer 8 is designed to be more standards compliant than previous versions. As a result, certain hacks in web sites can cause those sites to display incorrectly in Internet Explorer 8. This can be addressed by forcing browsers to render your site in what is called "compatibility mode". The following instructions detail how to enable compatibility mode site wide, if your site is hosted on an Apache server.

Setting Compatibility Mode for all visitors on Apache

Enabling compatibility mode on an Apache server requires the ability to create and edit .htaccess files, and mod_headers must be installed on the server. Most shared and dedicated hosting plans should allow this.

Simply add the following line to your .htaccess file.
Code:

Header set X-UA-Compatible "IE=EmulateIE7"

Setting Compatibility Mode for everyone but the webmaster

If you will be testing your site, and want your own browser to work without compatibility mode, you can specify certain IP addresses that will not be shown the header.

First, create a list of IP addresses that should not have compatibility mode. Add the following line to the .htaccess file, changing 1.2.3.4 to the appropriate address. Each IP address would require a seperate line.

SetEnvIf Remote_Addr 1.2.3.4 webmaster

This assigns the code "webmaster" to each specified IP address. Now, you would add the compatability header, telling it to display if the visitor has not been given the "webmaster" code. This is done by adding the following line to the .htaccess file after the lines you added above.

Header set X-UA-Compatible "IE=EmulateIE7" env=!webmaster

Everyone not from the specified IP address will be put in compatibility mode by default. Those visiting the site from the specified IP address(es) can enable compatibility if they want, but it will be disabled by default.

Setting Compatibility Mode on IIS 7

If you have administrative access to your IIS server, you can add new headers by following the instructions here: IIS 7.0: Add a Custom HTTP Response Header

The name you need to specify is "X-UA-Compatible" and the value is "IE=EmulateIE7" (without the quotes).

Setting Compatibility Mode on other platforms

If you can not use the above method for any reason, you can add compatibility mode to each page by adding the following meta tag:

<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7" />

Hiding Server Version Information

The less information an attacker has about a system, the more work that attacker has to do to find possible exploits, and the more chances Intrusion Detection Systems, firewalls and administrators have to detect the attack and stop it.

Given the version numbers of services running on a Web server, an attacker has an advantage in that the attacker can simply look up known vulnerabilities for that software and immediately attack them, without tipping off defensive systems with unsuccessful attempts. If the version numbers are hidden, the attacker has to guess, and try a variety of attacks, any of which might activate defensive systems running on the server. The following steps will allow webmasters to remove certain identifying information from Linux based servers. Some of these steps may not work on shared web hosts.

How the Information is Found

Before we go into hiding the information, it may be helpful to briefly discuss how an attacker finds the information in question. When a file is requested from a web server, the server attaches information about the document, called "headers", to the file. These headers contain information about the server software and the communication protocols involved in transmitting the document. This information is hidden from most web users, but can be viewed using various browser plugins, such as Live HTTP Headers for Firefox. The following are some sample headers that a web site might send when serving a page to a user:

1. HTTP/1.1 200 OK
2. Date: Tue, 24 Mar 2009 14:44:38 GMT
3. Server: Apache/2.0.55 (FreeBSD) PHP/5.1.2 mod_ssl/2.0.55 OpenSSL/0.9.8a
4. X-Powered-By: PHP/5.1.2
5. Expires: Thu, 19 Nov 1981 08:52:00 GMT
6. Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
7. Pragma: no-cache
8. Connection: close
9. Transfer-Encoding: chunked
10. Content-Type: text/html; charset=ISO-8859-1
11. Content-Language: en-us

The important lines are 3 and 4, which contain the server and PHP version numbers. These give a potential attacker information about the Apache server, PHP engine and operating system.

Hiding the Information

The first step is to hide the Operating System information and Apache version numbers. This is very easy to do, and only requires the addition of a single line to the server configuration file or .htaccess file:

ServerTokens Prod

That simple line will change line 3 above into the following:

3. Server: Apache

That's it.

The next step is to hide the information about PHP. That is slightly more difficult. The following line in the server configuration file or .htaccess file will remove line 4 in the above example completely:

Header unset X-Powered-By

Using this directive requires that the mod_headers package be installed and enabled in Apache. In most systems, the module will be available.

Of course, if you really wanted to get tricky, you could add some fun headers as well.

Header set X-AspNet-Version "2.0.50727"
Header set X-Powered-By "ASP.NET"

This would make the server look to an attacker as though it were running ASP on a Linux system (which is not very likely).