Question: We had feedback from our pentest report saying we should turn off server tokens. This is stop people being able to see which version of PHP we are using, and limit their ability to target the specific PHP version.

I have added the following to nginx.conf, under the http block:

```
server_tokens off;

```

But what tools can I use to check this change has taken affect?

Answer: 
Also, if you serve PHP projects, you may need to change in `/etc/nginx/{fastcgi,fastcgi_params).conf` 

```
fastcgi_param  SERVER_SOFTWARE    nginx;

```
Take a look at InSpec, a tool that allows you "turn your compliance, security, and other policy requirements into automated tests."

<https://www.inspec.io>

It can do all the configuration testing that you need for your Nginx server. Here's one way to test for the existence of the conf file and the value of `server_tokens`:

```
conf_path = '/etc/nginx/nginx.conf'

control 'Server tokens should be off' do
  describe file(conf_path) do
    it 'The config file should exist and be a file.' do
      expect(subject).to(exist)
      expect(subject).to(be_file)
    end
  end
  if (File.exist?(conf_path))
    Array(nginx_conf(conf_path).params['http']).each do |http|
      describe "http:" do
        it 'server_tokens should be off if found in the http context.' do
          Array(http["server_tokens"]).each do |tokens|
            expect(tokens).to(cmp 'off')
          end
        end
      end
    end
  end
end

```

If set correctly, InSpec returns:

```
  ✔  Server tokens should be off: File /etc/nginx/nginx.conf
     ✔  File /etc/nginx/nginx.conf The config file should exist and be a file.
     ✔  http: server_tokens should be off if found in the http context.

```

If not:

```
  ×  Server tokens should be off: File /etc/nginx/nginx.conf (1 failed)
     ✔  File /etc/nginx/nginx.conf The config file should exist and be a file.
     ×  http: server_tokens should be off if found in the http context.

     expected: "off"
          got: ["on"]

     (compared using `cmp` matcher)

```