Introduction

iRules are a powerful tool in the F5 administrators arsenal. They allow administrators to adapt and customize the F5 to their needs. They provide extensive power for security engineers as well. We’ve decided it’s time to revisit the Security iRules 101, with updated content, and 100% more monkeys!

In section 3 of the series, let’s talk about cloaking. Those of you whose first response was “I canna doit captain, I doona hav the powe”,  get a gold star for geek awesome.  (Scratching you head?  You need more Star Trek in your life!)   But no, not that kind of cloaking. Here we are talking about server cloaking.  Servers like to let everyone know who they are, what they do, what time they have, and what is for lunch. A raw server is a lot like the chatty human in the queue at the grocer, willing to tell you their life story. 

Why is this bad?

# echo -e "HEAD / HTTP\1.1\r\nhost:1.1.1.1\r\n\r\n"|nc 1.1.1.1 80

All this does is opens a Netcat connection to the server on port 80, and sends over a simple head request

Response from server:

What does an attacker do next? I grab the server and go to exploit-DB and see what vulnerabilities might be publically known for the application. The banner grab has made the attackers life easier, and no security monkey wants to do that.

iRule Response:

We can use an iRule to implement a good positive security model.  First we want to define what we should allow the headers to show.  To do that, let’s create a datagroup called allowed_headers:

ltm data-group internal /Common/allowed_headers {
    records {
        Accept-Range { }
        Cache-Control { }
        Content-Encoding { }
        Content-Length { }
        Content-Type { }
        ETag { }
        Last-Modified { }
        Pragma { }
        Set-Cookie { }
    }
    type string
}

These are pretty basic header options (most used in caching, etc).   Part two of the equation is the rule itself:

when HTTP_RESPONSE {
   foreach Headr [HTTP::header names] {
      if {not ([class match $Headr contains allowed_headers])}{
        log local0. "Removing: $Headr: [HTTP::header value $Headr]" 
        log local0. "Header: $Headr"
         HTTP::header remove $Headr
      }
   }
}

That’s it. 

A loop that goes through each header name in an HTTP_Response and looks for headers that are not on the allowed list. If it’s not on the list, we strip it out.

In practice: