In our periodic security scans, our HAProxy instances are always reported as a version disclosure vulnerability. On further inspection, it appears that there are no version banners in any responses and that nmap is responsible for detecting HAProxy based on some sort of fingerprinting.
Our HAProxy instances will autonomously redirect HTTP to HTTPS, while proxying the SSL traffic to the different backend systems. The version disclosure is only reported on the HTTP (80) port, not on the HTTPS (443) port
Here is a sample nmap output illustrating the issue:
$ nmap -sV --script=http-headers example.com PORT STATE SERVICE VERSION 80/tcp open http-proxy HAProxy http proxy 1.3.1 or later | http-headers: | Content-length: 0 | Location: https://example.com/ | Connection: close | |_ (Request type: GET) 443/tcp open ssl/http nginx | http-headers: | Server: nginx | Content-Type: application/json | Transfer-Encoding: chunked | Connection: close | Cache-Control: no-cache | Date: Thu, 06 Sep 2018 14:46:47 GMT | X-Frame-Options: SAMEORIGIN | X-Xss-Protection: 1; mode=block | X-Content-Type-Options: nosniff | Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' | Strict-Transport-Security: max-age=16000000; includeSubDomains; preload; | X-Forwarded-Proto: https | |_ (Request type: GET) |_http-server-header: nginx Service Info: Device: load balancer
How does nmap exactly fingerprint HAProxy, since there is no banner/header present to reveal its presence? I presume nmap it will look at the specific 301 payload or some TCP fingerprint which is unique to HAProxy.
And the ultimate question, how do I prevent nmap from detecting HAProxy in the first place?