Question: We had feedback from our pentest report saying we should turn off server tokens. This is stop people being able to see which version of PHP we are using, and limit their ability to target the specific PHP version.

I have added the following to nginx.conf, under the http block:

```
server_tokens off;

```

But what tools can I use to check this change has taken affect?

Answer: 
From the [manual](http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens) you know what the setting does:

> 
> **Syntax**: `server_tokens on | off`;  
> 
> **Default**: `server_tokens on`;  
> 
> **Context**: http, server, location 
> 
> 
> *Enables or disables emitting nginx version in error messages and in the “Server” response header field.*
> 
> 
> 

So your options are:

* generate an error message, for instance if you don't have a custom 404 error message simply request a non-existing page and in the footer you won't see the version information `nginx/1.2.3` any more.
* inspect the server headers and confirm that the version is no longer displayed.

A simple check to see the HTTP response headers is to manually connect i.e. with: `telnet www.example.com 80` where the client lines are what you enter:

> 
> client: HEAD / HTTP/1.1  
> 
>  client: Host: www.example.com 
> 
> 
> server: HTTP/1.1 200 OK  
> 
>  server: Date: Wed, 1 Jan 1970 22:13:05 GMT  
> 
>  server: **Server: Nginx/1.2.3**  
> 
>  server: Connection: close  
> 
>  server: Content-Type: text/html 
> 
> 
>
Take a look at InSpec, a tool that allows you "turn your compliance, security, and other policy requirements into automated tests."

<https://www.inspec.io>

It can do all the configuration testing that you need for your Nginx server. Here's one way to test for the existence of the conf file and the value of `server_tokens`:

```
conf_path = '/etc/nginx/nginx.conf'

control 'Server tokens should be off' do
  describe file(conf_path) do
    it 'The config file should exist and be a file.' do
      expect(subject).to(exist)
      expect(subject).to(be_file)
    end
  end
  if (File.exist?(conf_path))
    Array(nginx_conf(conf_path).params['http']).each do |http|
      describe "http:" do
        it 'server_tokens should be off if found in the http context.' do
          Array(http["server_tokens"]).each do |tokens|
            expect(tokens).to(cmp 'off')
          end
        end
      end
    end
  end
end

```

If set correctly, InSpec returns:

```
  ✔  Server tokens should be off: File /etc/nginx/nginx.conf
     ✔  File /etc/nginx/nginx.conf The config file should exist and be a file.
     ✔  http: server_tokens should be off if found in the http context.

```

If not:

```
  ×  Server tokens should be off: File /etc/nginx/nginx.conf (1 failed)
     ✔  File /etc/nginx/nginx.conf The config file should exist and be a file.
     ×  http: server_tokens should be off if found in the http context.

     expected: "off"
          got: ["on"]

     (compared using `cmp` matcher)

```