Scribd Logo
Upload

Welcome to Scribd!

  • 68 views

    Securing BIG-IP Generated HTTP Server Header Information

    Uploaded by

    rulohb83
    This document provides instructions for securing HTTP server header information generated by BIG-IP. It describes setting the server agent name field to null using the configuration utility or setting it to "none" using TMSH to prevent the HTTP Server header from being inserted on BIG-IP generated HTTP responses. It includes steps to modify an HTTP profile to remove the Server header.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Securing BIG-IP Generated HTTP Server Header Information

    Uploaded by

    rulohb83
    68 views5 pages
    This document provides instructions for securing HTTP server header information generated by BIG-IP. It describes setting the server agent name field to null using the configuration utility or setting it to "none" using TMSH to prevent the HTTP Server header from being inserted on BIG-IP generated HTTP responses. It includes steps to modify an HTTP profile to remove the Server header.

    Original Description:

    f5 labs

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document provides instructions for securing HTTP server header information generated by BIG-IP. It describes setting the server agent name field to null using the configuration utility or setting it to "none" using TMSH to prevent the HTTP Server header from being inserted on BIG-IP generated HTTP responses. It includes steps to modify an HTTP profile to remove the Server header.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    68 views5 pages

    Securing BIG-IP Generated HTTP Server Header Information

    Uploaded by

    rulohb83
    This document provides instructions for securing HTTP server header information generated by BIG-IP. It describes setting the server agent name field to null using the configuration utility or setting it to "none" using TMSH to prevent the HTTP Server header from being inserted on BIG-IP generated HTTP responses. It includes steps to modify an HTTP profile to remove the Server header.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 5

    DIGITAL EDUCATION SERIES

    JOB AID

    Securing BIG-IP
    Generated HTTP Server
    Header Information
    DIGITAL EDUCATION SERIES
    JOB AID

    TABLE OF CONTENTS

    Secure BIG-IP Generated HTTP Server Header Information 3


    Secure HTTP Profile Server Agent Name Using the Configuration Utility 3
    Secure HTTP Profile Server Agent Name Using TMSH 5

    DIGITAL 2
    EDUCATION
    SERIES
    BIG-IP ADMINISTRATOR TRAINING
    BIG-IP FUNDAMENTALS CURRICULUM

    SECURING BIG-IP GENERATED HTTP SERVER


    HEADER INFORMATION

    Secure BIG-IP Generated HTTP Server Header Information


    In a typical HTTP request through the BIG-IP proxy, the back-end server provides HTTP response headers, including
    perhaps an HTTP Server header, which is used to describe (or obfuscate) the agent that generated the response.
    But the BIG-IP system can also be configured to provide an HTTP response to the client without involving a server-
    side connection, such as when an iRule or local traffic policy is used to redirect or respond on the client-side
    connection. In such cases, the BIG-IP system includes (by default) an HTTP Server header in the response with its
    value set to BigIP. While this information can be useful during application delivery testing, both F5 and OWASP
    recommend you prevent the HTTP Server header from being inserted on a BIG-IP generated HTTP response. To do
    that, simply set the Server Agent Name field to a null value using the Configuration utility, or set server-agent-
    name to none using TMSH, as shown in the steps below.

    Secure HTTP Profile Server Agent Name Using the Configuration Utility

    Requirements: You must be an Administrator, Resource Administrator, or Manager to perform these steps.
    1. Navigate to Local Traffic » Profiles : Services : HTTP, and click on the name of the HTTP type services profile
    you wish to secure. In this example, we will select the HTTP-type profile named empty_server_agent.

    DIGITAL 3
    EDUCATION
    SERIES
    BIG-IP ADMINISTRATOR TRAINING
    BIG-IP FUNDAMENTALS CURRICULUM

    2. Scroll down to the bottom of the Settings section and:


    a. Click the Custom checkbox at the far right of the Server Agent Name setting.
    b. Remove the string BigIP from the Server Agent Name field. (Make it null - no spaces.)
    c. Click the Update button to save your configuration changes.

    DIGITAL 4
    EDUCATION
    SERIES
    BIG-IP ADMINISTRATOR TRAINING
    BIG-IP FUNDAMENTALS CURRICULUM

    Secure HTTP Profile Server Agent Name Using TMSH

    Requirements: You must be an Administrator, Resource Administrator, or Manager with TMOS shell access to
    perform the modify step below.
    1. List the current server-agent-name setting for the HTTP-type profile named empty_server_agent.

    (tmos)# list /ltm profile http empty_server_agent server-agent-name


    ltm profile http empty_server_agent {
    server-agent-name BigIP
    }

    2. Modify the HTTP-type profile named empty_server_agent to send no HTTP Server header in BIG-IP generated
    HTTP responses.

    (tmos)# modify /ltm profile http empty_server_agent server-agent-name none


    (tmos)# list /ltm profile http empty_server_agent server-agent-name
    ltm profile http empty_server_agent {
    server-agent-name none
    }

    3. If you want your changes to be permanent, remember to save the running configuration to the stored
    configuration. You must be an Administrator to perform this step.

    (tmos)# save /sys config

    DIGITAL 5
    EDUCATION
    SERIES

    You might also like