Hide or rewrite HTTP response Server Header from SSRS - security

I am using SSRS 2016 for my report. And every time I access a report, the response always contains the IIS server information. I want to hide or rewrite this sensitive information from the HTTP response Server header. Is there any way I can do it?
Reporting Services uses Http.sys directly from the server’s operating system to accept requests directed to URLs and ports configured for Reporting Services. This architectural change allows Reporting Services to exist without IIS and provides the same functionality. So, some suggestions to use URLRewrite extension and create an outbound rule in the internet does not help in this case.
Is there any way we can configure to hide/rewrite HTTP response Server header in Reporting Services Configuration Manager?

You could create an outbound rule to remove Server header like this
<outboundRules>
<rule name="rewrite">
<match serverVariable="RESPONSE_SERVER" pattern="(.*)" />
<action type="Rewrite" />
</rule>
</outboundRules>
Then you will see the value of Server header being removed.

Related

Windows IIS ARR Reverse Proxy Encoding Issue

We have an environment with an Windows 2019 Server IIS 10, which is acting as Reverse Proxy (ARR) for my IIS Server farm (Application Request Routing 3.0 and URL Rewrite 2.1). We send the users name in the HTTP headers. But my ARR somehow screws up the encoding (we are using german special characters, e.g. ö,ü,ß...), so when i check the respone of the WebServer it shows me: H%C3%B6lmuth M%C3%A4%C3%9Fterm%C3%BCller instead of Hölmuth Mäßtermüller.
I have an old environment with Windows 2012R2 Server with the same configuration, in this environment the display of the name is correct. I have checked all kind of settings between old and new servers, but cannot find any difference.
Futher i have used Failed Request Loggins and Network Monitor to see what the server receives and sends, below find the results.
Received Request on the IIS ARR (old and new):
X-AUTHENTICATE-FamilyName: M%C3%A4%C3%9Fterm%C3%Bcller
X-AUTHENTICATE-GivenName: H%C3%83%C2%B6lmuth
X-AUTHENTICATE-cn: H%C3%B6lmuth M%C3%A4%C3%9Fterm%C3%BCller
Request send to the IIS (new):
X-AUTHENTICATE-FamilyName: M%C3%A4%C3%9Fterm%C3%BCller
X-AUTHENTICATE-GivenName: H%C3%83%C2%B6lmuth
X-AUTHENTICATE-cn: H%C3%B6lmuth M%C3%A4%C3%9Fterm%C3%BCller
Request send to the IIS (old):
X-AUTHENTICATE-FamilyName: Mäßtermüller
X-AUTHENTICATE-GivenName: Hölmuth
X-AUTHENTICATE-cn: Hölmuth Mäßtermüller
Anyone has an idea how i can change this behaviour? Help would be much appreciated.
Can you give me an example how to use the {UNENCODED_URL} variable. Currently we are using the rewrite module to route requests to specific Server Farms, see my rules below:
<rewrite>
<globalRules useOriginalURLEncoding="true">
<rule name="ARR_BPBP-DEV_loadbalance" patternSyntax="Wildcard" stopProcessing="true">
<match url="*" />
<action type="Rewrite" url="http://BPBP-DEV/{R:0}" />
<conditions>
<add input="{HTTP_HOST}" pattern="bmi-bpbp-dev.vecos.at" />
</conditions>
</rule>
<rule name="ARR_BPBP-TEST_loadbalance" patternSyntax="Wildcard" stopProcessing="true">
<match url="*" />
<action type="Rewrite" url="http://BPBP-TEST/{R:0}" />
<conditions>
<add input="{HTTP_HOST}" pattern="bmi-bpbp-test.vecos.at" />
</conditions>
<serverVariables>
</serverVariables>
</rule>
</globalRules>
How can i adapt the rules to use the {UNENCODED_URL} variable?
When an HTTP request arrives on Windows, the latest HTTP.sys encodes both URL and HTTP headers, and puts the original URL in UNENCODED_URL server variable so that it can be recovered afterwards.
However, the original headers (such as X-AUTHENTICATE-FamilyName: Mäßtermüller) do not seem to be preserved (no clear documentation on that), so there isn't any easy way to recover them.
If you want to modify the the header from X-AUTHENTICATE-FamilyName: M%C3%A4%C3%9Fterm%C3%BCller back to X-AUTHENTICATE-FamilyName: Mäßtermüller, the only way I can think of is to write a custom IIS module to perform the decoding step.
Alternatively, you might modify your other code to accept such encoded header values (and decode them when needed in your code), as anyway that's how Windows/IIS behaves now and you cannot fight it.
Try to set the useOriginalURLEncoding to false, and URL rewrite will no longer encode the urls when using the {UNENCODED_URL} variable in the rules.
To set the flag to go IIS Manager then select Configuration Editor and go to the section system.webServer/rewrite/rules, where you will find the useOriginalURLEncoding flag.

Reverseproxy for WS using IIS

I have been searching all day long, but I don't have a clue how to solve this problem. I know there are similar questions here, but none seems to word.
I have an IIS server running on https://hostname.xy I deliver html and JS content from there and I have already configured a reverseproxy for SPA.
Now I am running a tomcat-server on port 7000 on the same server. The tomcat server accepts ws://..../.. requests.
All I want to do is communicating with that server. Requests get blocked because of mixed content. So I tried adding ssl to my tomcat server which is blocked because of a self signed certificate.
Is it possible to configure a reverse proxy that redirects all wss traffic to ws on a specific port? Could you share the specific rule from the web configuration in the IIS?
I tried next too many other rules this one here:
<rule name="WS reverse proxy" stopProcessing="true">
<match url="wss://myhostname.de/*" />
<action type="Rewrite" url="ws://127.0.0.1:7000/chat" logRewrittenUrl="true" />
</rule>

In a .Net Remoting service hosted in IIS 7.5, how can remove "Server : IIS/7.5" tag form response header

I have a .Net application which uses spring.net remoting to expose remoting services, over IIS 7.5.for security reasons, I want to remove some information like "Server: IIS/7.5" from HTTP response header.
I removed other tags like X-Powered-By easily, but, for the Server tag, I tried all the offered solutions on the internet and none of them worked. I tried setting the DisableServerHeader registry key or installing URLrewrite tools and changing my web.config and adding outboundRule or any other coding solution like adding a custom HTTP module or handling preRequestHandling of http context in my global.asax file. but none of them worked for me.
basically ,is it possible to remove this value, Server , from the response header, given that I'm using .net 3.5 and .net remoting over IIS 7.5?
I should mention that, this tag's value will become empty if I browse any pages that I've put into the host directory , but for my .Net remoting requests it's not working and the value of the server tag in response http header is still IIS/7.5
Unfortunately, you can not really remove the Server header. But you can rewrite its content and empty it. On IIS 7+ (IIS 7, 8.5, 8.0, 8.5, IIS 10.0), use a rewrite outbound rule to remove the webserver version information from the Server: header response.
You can use the following URL Rewrite Outbound rule:
<rewrite>
<outboundRules rewriteBeforeCache="true">
<rule name="Remove Server header">
<match serverVariable="RESPONSE_Server" pattern=".+" />
<action type="Rewrite" value="" />
</rule>
</outboundRules>
</rewrite>

URL ReWriting to a different server - rules are ignored and default website is answering requests

I'm struggling with IIS' URL Rewrite and ARR Modules.
Basically, here's the current state of affairs:
I have a main webserver, awnsering all of my requests. Let's name this MAINWEBSERVER.
I have a secondary server with a specific application that's working as intended if you access it internally but needs to be exposed to the outside via domain to work as a webservice. Let's name this server APPSERVER.
I wish to receive my requests on MAINWEBSERVER and rewrite the URL if it matches my wildcard.
In this case, my Wildcard is https://example.com/MYAPPLICATION* .
And my desired redirect is https://APPSERVER/MYAPPLICATION/WhateverIsLeftInTheUrl .
So here's my rule sitting on my MAINWEBSERVER:
<rewrite>
<rules>
<rule name="Rewrite to Application" patternSyntax="Wildcard" stopProcessing="true">
<match url="https://example.com/MYAPPLICATION*" />
<action type="Rewrite" url="https://APPSERVER/MYAPPLICATION{R:1}" logRewrittenUrl="true" />
</rule>
</rules>
</rewrite>
NOTE: I need the URL rewritten for certificate SAN purposes (it won't validate APPSERVER/MYAPPLICATION, so I want to use a mask that is validated by my certificate, such as https://example.com/MYAPPLICATION).
The steps I took were:
Installing ARR (activating proxy settings);
Installing URL ReWrite Module;
Configuring wildcard rule for https://example.com/MYAPPLICATION;
Configuring rewrite for https://APPSERVER/MYAPPLICATION{R:1} (in case it has querystrings I wish to keep them);
Generated personal certificates to validate HTTPS requests between MAINWEBSERVER and APPSERVER;
Whenever I make my request the rule is ignored (despite the same URL matching the wildcard perfectly) and the default website application awnsers, considering my wildcard a querystring parameter.
I've tried this both at server level and at default website level, even with Reverse Proxy Rules. I also have experimented with Fiddler and Failed Request Tracing but to no effect.
In the FRT all that is displayed is a 302 HTTP CODE and in the end a 200 Status Code when the default website loads.
Note that I believe this was working on a different server before, using this same rule although there was no default website.

Using IIS and ARR to reverse proxy returns "The server returned an invalid or unrecognized response"

I'm in the process of migrating from one site to another and, although the websites sit on the same server, they aren't in the same application pool.
As such, what I'm proposing is similar to the IIS article 'Reverse Proxy with URL Rewrite v2 and Application Request Routing'.
My setup as as follows:
Default Website (accepts connections on *:80 and *:443).
New Website (accepts connections on *:81)
I've enabled proxying in the ARR module and have one rewrite rule in 'New Website'. Currently, I only have one page in the new site (new-page), but this will increase gradually as we migrate over.
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<rewrite>
<rules>
<rule name="Reverse Proxy to New Website" stopProcessing="true">
<match url="^new-page" />
<action type="Rewrite" url="http://www.mysite.com:81/new-page" />
</rule>
</rules>
</rewrite>
</system.webServer>
</configuration>
When I go to www.mysite.com/index.htm, I see my old homepage, which is correct.
However, if I go to www.mysite.com/new-page, I receive an error:
HTTP Error 502.3 Bad Gateway
The server returned an invalid or unrecognized response
Any help with this would be greatly appreciated.
Edit:
I have also enabled WinHttp tracing, and a log of the request today can be found here at pastebin.
I have some further information (retrieved from IIS Failed Request Logging) below.
It appears that ARR has an issue with headers that have spaces in.
The new application has a single header with a space, and replacing it with a hyphen fixed the issue.
I just ran into this. However, my problem had to do with conflicting cookies.
A good test is to use a different browser (or incognito in Chrome). If it works on the other browser, it could be the cookies. Try deleting the cookies to see if that helps. If it's something you can control, try changing the cookie name between different sites/environments you may have. If it's out of your control (you're doing a reverse proxy to some tool you've purchased, this may not be possible).

Resources