Fixing Presence of Load balancer detected issueIs it possible to rate limit based on host headers? i.e. not just on ip addressn00bie Linode VPS - am I reasonably secure? How to audit?Issues with EC2 Elastic Load Balancer DNS and routingAutoscaling with AWS load-balancerApache log general analyzer with vhostsHow to scale up a web server supporting long pollingEC2 Failing Load Balancer Health CheckConfiguring WAF + ALB to Prevent SQL InjectionUsing HTTP proxies for load balancingShould I worry about hanging sockets when setting keep-alive timeout to Infinity?
Can a generation ship withstand its own oxygen and daily wear for many thousands of years?
Is there any deeper thematic meaning to the white horse that Arya finds in The Bells (S08E05)?
Why does string strummed with finger sound different from the one strummed with pick?
Why use a retrograde orbit?
Are there any crystals that are theoretically possible, but haven't yet been made?
Why are stats in Angband written as 18/** instead of 19, 20...?
Referring to a character in 3rd person when they have amnesia
Merging two rows with rounding their first elemnts
How to get all possible paths in 0/1 matrix better way?
Taylor series leads to two different functions - why?
Divisor Rich and Poor Numbers
Failing students when it might cause them economic ruin
What were the "pills" that were added to solid waste in Apollo 7?
How to draw pentagram-like shape in Latex?
How to laser-level close to a surface
Would it be fair to use 1d30 (instead of rolling 2d20 and taking the higher die) for advantage rolls?
What do you call bracelets you wear around the legs?
How can sister protect herself from impulse purchases with a credit card?
Have the writers and actors of GOT responded to its poor reception?
Is it standard to have the first week's pay indefinitely withheld?
Have GoT's showrunners reacted to the poor reception of the final season?
Shortest amud or daf in Shas?
How does this piece of code determine array size without using sizeof( )?
In Dutch history two people are referred to as "William III"; are there any more cases where this happens?
Fixing Presence of Load balancer detected issue
Is it possible to rate limit based on host headers? i.e. not just on ip addressn00bie Linode VPS - am I reasonably secure? How to audit?Issues with EC2 Elastic Load Balancer DNS and routingAutoscaling with AWS load-balancerApache log general analyzer with vhostsHow to scale up a web server supporting long pollingEC2 Failing Load Balancer Health CheckConfiguring WAF + ALB to Prevent SQL InjectionUsing HTTP proxies for load balancingShould I worry about hanging sockets when setting keep-alive timeout to Infinity?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
I have a setup with Amazon EC2 running my webapp while the domain hosted at cloudflare. I dont have any kind of Load balancer setup in my infra. Yet when we run the security test at Qualys, the report showed us Severity 1 vulnerability as "Presence of a Load-Balancing Device Detected".
The good thing about the report is that it also mentioned about how to fix this issue. The following snippet is the part of the report
THREAT :
The service detected a load-balancing device in front of your Web servers. This information can provide an attacker with additional information about your network.
Different techniques were used to detect the presence of a load-balancing device, including HTTP header analysis and analysis of IP Time-T o-Live (TTL) values, IP Identification (ID) values, and TCP Initial Sequence Numbers (ISN). The actual technique(s) responsible for the detection can be seen in the Result section.
The exact number of Web servers behind a load balancer is difficult to determine, so the number reported here may not be accurate. Furthermore, Netscape Enterprise Server Version 3.6 is known to display an erroneous "Date:" field in the HTTP header when the server receives a lot of requests. This makes it difficult for the service to determine if there is a load-balancing device present by analyzing the HTTP headers. Also, the result given by the analysis of IP ID and TCP ISN values may vary due to different network conditions when the scan was performed.
IMP ACT :
By exploiting this vulnerability, an intruder could use this information in conjunction with other pieces of information to craft sophisticated attacks against your network.
Note also that if the Web servers behind the load balancer are not identical, the scan results for the HTTP vulnerabilities may vary from one scan to another .
SOLUTION:
To prevent the detection of the presence of a load-balancing device based on HTTP header analysis, you should use Network-Time-Protocol (NTP) to synchronize the clocks on all of your hosts (at least those in the DMZ).
To prevent detection by analyzing IP TTL values, IP ID values, and TCP ISN values, you may use hosts with a TCP/IP implementation that generates randomized numbers for these values. However, most operating systems available today do not come with such a TCP/IP implementation.
COMPLIANCE: Not Applicable
EXPLOIT ABILITY :
There is no exploitability information for this vulnerability.
ASSOCIATED MALWARE:
There is no malware information for this vulnerability.
RESULTS:
Number of web servers behind load balancer: 100 - based on HTTP headers
The problem with this report and the solution is that I dont have any load balancer setup so I'm unable to synchronize my server clock(what should i synchronize it with if there isn't any load balancer/hosts for me to set up NTP on it)
ubuntu amazon-ec2 cloudflare
asked May 6 at 10:27
cyberrspirittcyberrspiritt
1012
add a comment |
I have a setup with Amazon EC2 running my webapp while the domain hosted at cloudflare. I dont have any kind of Load balancer setup in my infra. Yet when we run the security test at Qualys, the report showed us Severity 1 vulnerability as "Presence of a Load-Balancing Device Detected".
The good thing about the report is that it also mentioned about how to fix this issue. The following snippet is the part of the report
THREAT :
The service detected a load-balancing device in front of your Web servers. This information can provide an attacker with additional information about your network.
Different techniques were used to detect the presence of a load-balancing device, including HTTP header analysis and analysis of IP Time-T o-Live (TTL) values, IP Identification (ID) values, and TCP Initial Sequence Numbers (ISN). The actual technique(s) responsible for the detection can be seen in the Result section.
The exact number of Web servers behind a load balancer is difficult to determine, so the number reported here may not be accurate. Furthermore, Netscape Enterprise Server Version 3.6 is known to display an erroneous "Date:" field in the HTTP header when the server receives a lot of requests. This makes it difficult for the service to determine if there is a load-balancing device present by analyzing the HTTP headers. Also, the result given by the analysis of IP ID and TCP ISN values may vary due to different network conditions when the scan was performed.
IMP ACT :
By exploiting this vulnerability, an intruder could use this information in conjunction with other pieces of information to craft sophisticated attacks against your network.
Note also that if the Web servers behind the load balancer are not identical, the scan results for the HTTP vulnerabilities may vary from one scan to another .
SOLUTION:
To prevent the detection of the presence of a load-balancing device based on HTTP header analysis, you should use Network-Time-Protocol (NTP) to synchronize the clocks on all of your hosts (at least those in the DMZ).
To prevent detection by analyzing IP TTL values, IP ID values, and TCP ISN values, you may use hosts with a TCP/IP implementation that generates randomized numbers for these values. However, most operating systems available today do not come with such a TCP/IP implementation.
COMPLIANCE: Not Applicable
EXPLOIT ABILITY :
There is no exploitability information for this vulnerability.
ASSOCIATED MALWARE:
There is no malware information for this vulnerability.
RESULTS:
Number of web servers behind load balancer: 100 - based on HTTP headers
The problem with this report and the solution is that I dont have any load balancer setup so I'm unable to synchronize my server clock(what should i synchronize it with if there isn't any load balancer/hosts for me to set up NTP on it)
ubuntu amazon-ec2 cloudflare
asked May 6 at 10:27
cyberrspirittcyberrspiritt
1012
This looks like a nonsense detection of a nonexistent vulnerability. CloudFlare uses load balancers in its infrastructure, so if your site is actually using CloudFlare (for more than just DNS -- you didn't specifically say) then your site is using their load balancers. The explanation "Number of web servers behind load balancer: 100 - based on HTTP header" doesn't give you any useful information.
– Michael - sqlbot
May 6 at 20:28
Yes we're using Origin SSL certs from Cloudflare. Any way to get rid of this vulnerability?
– cyberrspiritt
May 7 at 3:41
1
I am strongly inclined to insist that this is an entirely false detection -- not a genuine vulnerability -- and thus a meaningless report.
– Michael - sqlbot
May 7 at 12:43
add a comment |
I have a setup with Amazon EC2 running my webapp while the domain hosted at cloudflare. I dont have any kind of Load balancer setup in my infra. Yet when we run the security test at Qualys, the report showed us Severity 1 vulnerability as "Presence of a Load-Balancing Device Detected".
The good thing about the report is that it also mentioned about how to fix this issue. The following snippet is the part of the report
THREAT :
The service detected a load-balancing device in front of your Web servers. This information can provide an attacker with additional information about your network.
Different techniques were used to detect the presence of a load-balancing device, including HTTP header analysis and analysis of IP Time-T o-Live (TTL) values, IP Identification (ID) values, and TCP Initial Sequence Numbers (ISN). The actual technique(s) responsible for the detection can be seen in the Result section.
The exact number of Web servers behind a load balancer is difficult to determine, so the number reported here may not be accurate. Furthermore, Netscape Enterprise Server Version 3.6 is known to display an erroneous "Date:" field in the HTTP header when the server receives a lot of requests. This makes it difficult for the service to determine if there is a load-balancing device present by analyzing the HTTP headers. Also, the result given by the analysis of IP ID and TCP ISN values may vary due to different network conditions when the scan was performed.
IMP ACT :
By exploiting this vulnerability, an intruder could use this information in conjunction with other pieces of information to craft sophisticated attacks against your network.
Note also that if the Web servers behind the load balancer are not identical, the scan results for the HTTP vulnerabilities may vary from one scan to another .
SOLUTION:
To prevent the detection of the presence of a load-balancing device based on HTTP header analysis, you should use Network-Time-Protocol (NTP) to synchronize the clocks on all of your hosts (at least those in the DMZ).
To prevent detection by analyzing IP TTL values, IP ID values, and TCP ISN values, you may use hosts with a TCP/IP implementation that generates randomized numbers for these values. However, most operating systems available today do not come with such a TCP/IP implementation.
COMPLIANCE: Not Applicable
EXPLOIT ABILITY :
There is no exploitability information for this vulnerability.
ASSOCIATED MALWARE:
There is no malware information for this vulnerability.
RESULTS:
Number of web servers behind load balancer: 100 - based on HTTP headers
The problem with this report and the solution is that I dont have any load balancer setup so I'm unable to synchronize my server clock(what should i synchronize it with if there isn't any load balancer/hosts for me to set up NTP on it)
ubuntu amazon-ec2 cloudflare
asked May 6 at 10:27
cyberrspirittcyberrspiritt
1012
I have a setup with Amazon EC2 running my webapp while the domain hosted at cloudflare. I dont have any kind of Load balancer setup in my infra. Yet when we run the security test at Qualys, the report showed us Severity 1 vulnerability as "Presence of a Load-Balancing Device Detected".
The good thing about the report is that it also mentioned about how to fix this issue. The following snippet is the part of the report
THREAT :
The service detected a load-balancing device in front of your Web servers. This information can provide an attacker with additional information about your network.
Different techniques were used to detect the presence of a load-balancing device, including HTTP header analysis and analysis of IP Time-T o-Live (TTL) values, IP Identification (ID) values, and TCP Initial Sequence Numbers (ISN). The actual technique(s) responsible for the detection can be seen in the Result section.
The exact number of Web servers behind a load balancer is difficult to determine, so the number reported here may not be accurate. Furthermore, Netscape Enterprise Server Version 3.6 is known to display an erroneous "Date:" field in the HTTP header when the server receives a lot of requests. This makes it difficult for the service to determine if there is a load-balancing device present by analyzing the HTTP headers. Also, the result given by the analysis of IP ID and TCP ISN values may vary due to different network conditions when the scan was performed.
IMP ACT :
By exploiting this vulnerability, an intruder could use this information in conjunction with other pieces of information to craft sophisticated attacks against your network.
Note also that if the Web servers behind the load balancer are not identical, the scan results for the HTTP vulnerabilities may vary from one scan to another .
SOLUTION:
To prevent the detection of the presence of a load-balancing device based on HTTP header analysis, you should use Network-Time-Protocol (NTP) to synchronize the clocks on all of your hosts (at least those in the DMZ).
To prevent detection by analyzing IP TTL values, IP ID values, and TCP ISN values, you may use hosts with a TCP/IP implementation that generates randomized numbers for these values. However, most operating systems available today do not come with such a TCP/IP implementation.
COMPLIANCE: Not Applicable
EXPLOIT ABILITY :
There is no exploitability information for this vulnerability.
ASSOCIATED MALWARE:
There is no malware information for this vulnerability.
RESULTS:
Number of web servers behind load balancer: 100 - based on HTTP headers
The problem with this report and the solution is that I dont have any load balancer setup so I'm unable to synchronize my server clock(what should i synchronize it with if there isn't any load balancer/hosts for me to set up NTP on it)
ubuntu amazon-ec2 cloudflare
ubuntu amazon-ec2 cloudflare
asked May 6 at 10:27
cyberrspirittcyberrspiritt
1012
asked May 6 at 10:27
cyberrspirittcyberrspiritt
1012
asked May 6 at 10:27
cyberrspirittcyberrspiritt
1012
asked May 6 at 10:27
cyberrspirittcyberrspiritt
1012
asked May 6 at 10:27
cyberrspirittcyberrspiritt
1012
1012
This looks like a nonsense detection of a nonexistent vulnerability. CloudFlare uses load balancers in its infrastructure, so if your site is actually using CloudFlare (for more than just DNS -- you didn't specifically say) then your site is using their load balancers. The explanation "Number of web servers behind load balancer: 100 - based on HTTP header" doesn't give you any useful information.
– Michael - sqlbot
May 6 at 20:28
Yes we're using Origin SSL certs from Cloudflare. Any way to get rid of this vulnerability?
– cyberrspiritt
May 7 at 3:41
1
I am strongly inclined to insist that this is an entirely false detection -- not a genuine vulnerability -- and thus a meaningless report.
– Michael - sqlbot
May 7 at 12:43
add a comment |
This looks like a nonsense detection of a nonexistent vulnerability. CloudFlare uses load balancers in its infrastructure, so if your site is actually using CloudFlare (for more than just DNS -- you didn't specifically say) then your site is using their load balancers. The explanation "Number of web servers behind load balancer: 100 - based on HTTP header" doesn't give you any useful information.
– Michael - sqlbot
May 6 at 20:28
Yes we're using Origin SSL certs from Cloudflare. Any way to get rid of this vulnerability?
– cyberrspiritt
May 7 at 3:41
1
I am strongly inclined to insist that this is an entirely false detection -- not a genuine vulnerability -- and thus a meaningless report.
– Michael - sqlbot
May 7 at 12:43
This looks like a nonsense detection of a nonexistent vulnerability. CloudFlare uses load balancers in its infrastructure, so if your site is actually using CloudFlare (for more than just DNS -- you didn't specifically say) then your site is using their load balancers. The explanation "Number of web servers behind load balancer: 100 - based on HTTP header" doesn't give you any useful information.
– Michael - sqlbot
May 6 at 20:28
This looks like a nonsense detection of a nonexistent vulnerability. CloudFlare uses load balancers in its infrastructure, so if your site is actually using CloudFlare (for more than just DNS -- you didn't specifically say) then your site is using their load balancers. The explanation "Number of web servers behind load balancer: 100 - based on HTTP header" doesn't give you any useful information.
– Michael - sqlbot
May 6 at 20:28
Yes we're using Origin SSL certs from Cloudflare. Any way to get rid of this vulnerability?
– cyberrspiritt
May 7 at 3:41
Yes we're using Origin SSL certs from Cloudflare. Any way to get rid of this vulnerability?
– cyberrspiritt
May 7 at 3:41
1
1
I am strongly inclined to insist that this is an entirely false detection -- not a genuine vulnerability -- and thus a meaningless report.
– Michael - sqlbot
May 7 at 12:43
I am strongly inclined to insist that this is an entirely false detection -- not a genuine vulnerability -- and thus a meaningless report.
– Michael - sqlbot
May 7 at 12:43
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f966030%2ffixing-presence-of-load-balancer-detected-issue%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f966030%2ffixing-presence-of-load-balancer-detected-issue%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
This looks like a nonsense detection of a nonexistent vulnerability. CloudFlare uses load balancers in its infrastructure, so if your site is actually using CloudFlare (for more than just DNS -- you didn't specifically say) then your site is using their load balancers. The explanation "Number of web servers behind load balancer: 100 - based on HTTP header" doesn't give you any useful information.
– Michael - sqlbot
May 6 at 20:28
Yes we're using Origin SSL certs from Cloudflare. Any way to get rid of this vulnerability?
– cyberrspiritt
May 7 at 3:41
1
I am strongly inclined to insist that this is an entirely false detection -- not a genuine vulnerability -- and thus a meaningless report.
– Michael - sqlbot
May 7 at 12:43