How to hide that Nginx is a reverse proxy?

campos

4/16/23, 5:29 PM

Running the command nmap -A -sS mysite.com, it was demonstrated that the server is Nginx and that it is used as a proxy. Is it possible to hide this information?

Command output: 80/tcp open http nginx (reverse proxy)

I am using Nginx 1.18.0. In my nginx.conf, I set the settings (Some non-security settings have been hidden. The "..." means that.):

load_module modules/ngx_http_headers_more_filter_module.so;

user                 www-data;
pid                  /run/nginx.pid;
worker_processes     auto;
worker_rlimit_nofile 65535;

events {
    multi_accept       on;
    worker_connections 65535;
}

http {
     ...
     more_set_headers       'Server: none';
     server_tokens          off;
     ...

    # Connection header for WebSocket reverse proxy
    map $http_upgrade $connection_upgrade {
        default upgrade;
        ""      close;
    }

    # Load configs
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;

}

0 + 0

nginx

web-server

reverse-proxy

djdomi

4/16/23, 6:06 PM

and what should this protect you from what? nginx is by design a reverse proxy, so even you hide the word, it would not protect you from anything

campos

4/16/23, 7:50 PM

@djdomi The idea of hiding information about services comes from hardening studies. The smaller the amount of information, the more difficult it is to carry out an attack.

djdomi

4/16/23, 8:50 PM

security by obscurity never worked in the past. So next argument why ypu want to do it? ;) `server_tokens off;` may be the function you are looking for. moreover if you running php remind for `expose_php = off`

Score:0

Server

w0nd3r365

10/28/23, 9:49 AM

Try removing more_set_headers directive and run Nmap again. I noticed that Nmap detects nginx as a reverse proxy when I set the directive in my nginx.conf file but failed to detect it as such when I commented out the directive.

+ 0