starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Enable or disable Verson in footer #4876

New Issue
Closed
opened 2025-12-29 19:21:35 +01:00 by adam · 5 comments
adam commented 2025-12-29 19:21:35 +01:00
Owner
Copy Link

Originally created by @sthierolf on GitHub (May 5, 2021).

NetBox version

v2.11.1

Feature type

New functionality

Proposed functionality

As optional configuration setting, I would like to request an EXPOSE_VERSION setting.

EXPOSE_VERSION = True - The host name and version is displayed in the footer
EXPOSE_VERSION = False - The host name and version is not displayed or just replaced with netbox

Should work similar to Apache "ServerTokens Prod" or Nginx "server_tokens off" to hide host name and version, especially for netbox installations running in the public Internet.

Use case

If netbox host is running in the public Internet, the goal for services (Apache, nginx, ...) is always to reduce the attack surface.
Hiding the netbox host name and version increases the security a bit ("Exposure of Information").
Some Institutions like BSI (Bundesamt für Sicherheit in der Informationstechnik / German Federal Office for Information Security) suggests to disable version or banners as well on web based applications

Database changes

No response

External dependencies

No response

Originally created by @sthierolf on GitHub (May 5, 2021). ### NetBox version v2.11.1 ### Feature type New functionality ### Proposed functionality As optional configuration setting, I would like to request an EXPOSE_VERSION setting. EXPOSE_VERSION = True - The host name and version is displayed in the footer EXPOSE_VERSION = False - The host name and version is not displayed or just replaced with netbox Should work similar to Apache "ServerTokens Prod" or Nginx "server_tokens off" to hide host name and version, especially for netbox installations running in the public Internet. ### Use case If netbox host is running in the public Internet, the goal for services (Apache, nginx, ...) is always to reduce the attack surface. Hiding the netbox host name and version increases the security a bit ("Exposure of Information"). Some Institutions like BSI (Bundesamt für Sicherheit in der Informationstechnik / German Federal Office for Information Security) suggests to disable version or banners as well on web based applications ### Database changes _No response_ ### External dependencies _No response_
adam added the type: featurestatus: needs ownerpending closure labels 2025-12-29 19:21:35 +01:00
adam closed this issue 2025-12-29 19:21:35 +01:00
adam commented 2025-12-29 19:21:36 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (May 5, 2021):

Hiding the netbox host name and version increases the security a bit ("Exposure of Information").

It doesn't really, though: This is a textbook example of security through obscurity.

I think it would make sense to show the hostname and version information only for authenticated users, however introducing a configuration parameter for this would be unnecessary.

@jeremystretch commented on GitHub (May 5, 2021): > Hiding the netbox host name and version increases the security a bit ("Exposure of Information"). It doesn't really, though: This is a textbook example of [security through obscurity](https://en.wikipedia.org/wiki/Security_through_obscurity). I think it would make sense to show the hostname and version information only for authenticated users, however introducing a configuration parameter for this would be unnecessary.
adam commented 2025-12-29 19:21:36 +01:00
Author
Owner
Copy Link

@sthierolf commented on GitHub (May 5, 2021):

I agree, security through obscurity, but also used to raise the attempts for "unwanted individuals" a little bit higher.

Host + version information after authentication will do, but this information should not be shown on the login page.

@sthierolf commented on GitHub (May 5, 2021): I agree, security through obscurity, but also used to raise the attempts for "unwanted individuals" a little bit higher. Host + version information after authentication will do, but this information should not be shown on the login page.
adam commented 2025-12-29 19:21:36 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (May 18, 2021):

There's also the /api/status/ endpoint which currently reveals this information to unauthenticated users. This would also need to be locked down somehow, without sacrificing the basic functionality of the endpoint for unauthenticated users.

@jeremystretch commented on GitHub (May 18, 2021): There's also the `/api/status/` endpoint which currently reveals this information to unauthenticated users. This would also need to be locked down somehow, without sacrificing the basic functionality of the endpoint for unauthenticated users.
adam commented 2025-12-29 19:21:36 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Jul 18, 2021):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. NetBox is governed by a small group of core maintainers which means not all opened issues may receive direct feedback. Please see our contributing guide.

@github-actions[bot] commented on GitHub (Jul 18, 2021): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. NetBox is governed by a small group of core maintainers which means not all opened issues may receive direct feedback. Please see our [contributing guide](https://github.com/netbox-community/netbox/blob/develop/CONTRIBUTING.md).
adam commented 2025-12-29 19:21:36 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Aug 17, 2021):

This issue has been automatically closed due to lack of activity. In an effort to reduce noise, please do not comment any further. Note that the core maintainers may elect to reopen this issue at a later date if deemed necessary.

@github-actions[bot] commented on GitHub (Aug 17, 2021): This issue has been automatically closed due to lack of activity. In an effort to reduce noise, please do not comment any further. Note that the core maintainers may elect to reopen this issue at a later date if deemed necessary.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label pending closure status: needs owner type: feature
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#4876
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?