nginx [engine x] is an HTTP and reverse proxy server, written by Igor Sysoev

learn more… | top users | synonyms

0
votes
0answers
11 views

Is there an original informaton source linking output of Qualys SSL report to settings in nginx and Apache configurations?

The online tool at Qualys for testing webserver SSL configurations, https://www.ssllabs.com/ssltest/index.html, produces a list of codeslike TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, ...
2
votes
3answers
80 views

Does a reverse proxy pass keep the backend server anonymous?

If I have an NGINX server at 1.1.1.1 and in the NGINX server you have the config that forwards on http traffic to 2.2.2.2: upstream 123 { server 2.2.2.2; } server { listen 80 default_server; ...
1
vote
1answer
66 views

Nginx: How to block IP by hostname regex

I'm running a small wordpress site with nginx + php5-fpm. I have noticed that I get a lot of botnet attacks from IPs with hostnames like: 52-182.static.spheral.ru 208-135.static.spheral.ru 118-239....
33
votes
4answers
39k views

Strange requests to web server

I have a Linode VPS running Nginx, which currently serves only static content. Once I was looking at the log and noticed some strange requests: XXX.193.171.202 - - [07/Aug/2013:14:04:36 +0400] "GET /...
1
vote
1answer
61 views

Transparent pixel in nginx error log…Is this hacking?

I'm assuming this is a hacker, but what gives here. 2016/05/06 20:10:01 [error] 11878#0: *4135 open() "/usr/local/www/nginx/MYDOMAIN/public_html/images/G/01/x-loc ale/common/transparent-...
1
vote
1answer
46 views

Securely opening an insecure webserver to a single phone

I have a webserver running inside my private network and not exposed to the internet. I'd like to securely talk to this webserver from my mobile phone over the internet. However, this webserver has ...
0
votes
2answers
113 views

Security concerns when using nginx as a lightweight URL shortener

I wish to use nginx as a lightweight URL shortener. To be exact, assuming my domain name is example.com, I have this most basic nginx.conf: events {} http { server { listen 80; location = /...
2
votes
1answer
64 views

Is it a good practice to forbid ip access to port 80?

I see some sites have blocked there port 80 (or 443) to be accessed by IP. When you access by IP, An Nginx forbidden page shows up (with there OS version). My question is does it affect any side of ...
4
votes
1answer
73 views

What does an unquoted shell variable allow?

I have the following dash (dash is the default Ubuntu shell instead of bash) code which run in a server side script. This script is not run by the root user. git clone -b $DEFAULT_BRANCH file://$...
2
votes
0answers
85 views

Nginx forwarding undesired hosts to Django

I've been getting errors from Django on my webserver (behind Nginx/uWSGI) complaining that it's being accessed with a request where the Host is the IP address of the server. Nginx is using virtual ...
1
vote
1answer
89 views

Was my phpMyAdmin hacked?

On a server of mine I have a current version of phpMyAdmin running. Unfortunately (my bad I knew I hat to delete this folder for security after installation, I simply forgot... dangit) I still had the ...
5
votes
1answer
69 views

Regenerating dhparam periodically

Does it increase connection security if I regenerate the dhparam files used with NGINX on our servers periodically e.g. every week? What issues may arise from this? Is there any benefit in doing ...
0
votes
2answers
78 views

Make nginx drop requests to timeout client on purpose

I want to avoid nginx from processing requests and hiding the fact that it even exists at a certain IP by not answering at all. The requests should be dropped and the client's browser should time out ...
0
votes
0answers
135 views

Wordpress pingback attack

I am getting Wordpress pingback attach on my server. I tried to put if condition on nginx to block deny all requests that contains "Wordpress" in the header. It works fine but still nginx get millions ...
4
votes
0answers
230 views

CRL check for TLS client certificate on Linux?

I run a HTTPS web service. Clients authenticate using a TLS Client Certificate. How do I configure a standard Linux web server (preferably Apache) to validate client certificates against their CRLs? ...
1
vote
1answer
83 views

phpBB under nginx, htaccess protection is lost – what are the risks?

I'm running phpBB 3.1 on a server that uses nginx not Apache, and due to this, none of the phpBB .htaccess files work, and so files in the document root that are normally protected under Apache, are ...
8
votes
3answers
8k views

nginx - How to prevent processing requests with undefined server names with HTTPS

How do I avoid nginx processing a request with an undefined server name using the https protocol. The following configuration makes this work for normal http requests. It resets the connection for ...
9
votes
3answers
2k views

How can I explain to the client that rfc2385 TCP MD5 Checksums can't be turned on for linux webservers?

I've had a long running conversation with a client where they perform a Rapid7 security scan which then warns about TCP MD5 checksums missing on port 80. This is what I think I know: RFC 2385 was ...
1
vote
0answers
111 views

how to configure naxsi to accept json format in rest apis?

For example one of my APIs is: Post request: /api/v0/login body: { "username":"xxx@ggg.com", "password":"eeeee" } I want to secure this API with naxsi, I could not find anywhere to config naxsi ...
2
votes
1answer
1k views

Any security risk with raising client_max_body_size nginx?

i was wondering if there is any securitiy risk involved with raising the client_max_body_size in nginx from 1MB to 20GB?
3
votes
3answers
2k views

SSL ciphers for nginx to support CloudFlare and CloudFront

Could someone suggest an optimal ssl cipher configuration for my nginx server that supports both CloudFlare and CloudFront? I have tried a few of the suggestions in other threads, but CloudFront ...
2
votes
1answer
2k views

Nginx - SSL Website shows up on desktop but not mobile

So I bought a Comodo SSL from Namecheap and put my site up on a Ubuntu droplet on DigitalOcean on a nginx server. My default virtual host file on /etc/nginx/sites-available/: server { listen ...
49
votes
7answers
34k views

Trying to make a Django-based site use HTTPS-only, not sure if it's secure?

The EFF recommends using HTTPS everywhere on your site, and I'm sure this site would agree. When I asked a question about using Django to implement HTTPS on my login page, that was certainly the ...
3
votes
0answers
796 views

Nginx and HSM integration to hold private keys

We are using Nginx and storing private keys in file on server. We would like to move private keys to HSM, so that ssl keys are stored in HSM and never leaves HSM. All crypto operations required during ...
8
votes
1answer
2k views

Is every hash format that nginx accepts for HTTP Basic Auth weak against brute force?

According to http://nginx.org/en/docs/http/ngx_http_auth_basic_module.html nginx can read password hashes of these types: crypt(), apr1, SHA1 & SSHA. This is how I understand how these hashes ...
25
votes
6answers
39k views

Recommended ssl_ciphers for security, compatibility - Perfect Forward secrecy

I'm currently using nginx with the following ciphers: ssl_ciphers HIGH:!aNULL:!eNULL:!LOW:!ADH:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS; I would like to maintain compatibility to older browsers, ...
2
votes
1answer
262 views

Understanding a suspicious HTTP request

While debugging my server for issues, I checked my logs frequently. Here is one weird one I've found, which seems like an attempt to run something on my server. I am using nginx on Ubuntu 14.04. Below ...
1
vote
1answer
2k views

End-to-end encryption with a reverse proxy and an application server

Lets say that I have an nginx reverse proxy that proxies the traffic to a Tomcat on the same server. I think the most common way to configure this setup is to enable SSL on nginx and then proxy the ...
1
vote
1answer
1k views

strange web server log activity

I've noticed some suspicious activity in my webser logs: 188.165.66.110 - - [20/Feb/2015:03:58:28 +0000] "GET /?x=()?x=()?x=()?x=() {:; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`...
2
votes
1answer
389 views

Basic nginx securing / restricted access [closed]

I run a private virtual server on Ubuntu 14.04 and I use Nginx as my http server and/or reverse proxy. I run multiple webapps on this server, most of them are fresh open source projects. UPDATE : ...
2
votes
0answers
337 views

Startcom StartSSL + nginx client certificate

Startcom issues client certs. I'm using mine for seamless authentication in nginx as follows, in somewhat the same manner as was suggested by this Q/A: server { ssl_certificate /path/to/my/...
2
votes
1answer
320 views

What are empty requests in web server log?

In my nginx access.log I have plenty of request logs like this: 1.2.3.4 - - [18/Aug/2014:12:09:33 +0200] "-" 400 0 "-" "-" As you see there is neither browser specification nor any target url. I ...
9
votes
2answers
10k views

SSL/TLS: How to fix “Chain issues: Contains anchor”

I just ran a quick test at ssllabs.com: got A+, which I'm happy about. However there's one thing I don't know how to "fix": My site supports OCSP stapling and ssllabs keeps telling me: Chain issues: ...
3
votes
2answers
3k views

nginx recommended ssl_ciphers

I am looking for some advice on setting the ciphers for nginx with SSL. What would you recommend for a good compromise between security and compatiblity at the moment? I have made some research but ...
4
votes
1answer
824 views

HTTP attack taking down PHP-FPM [closed]

Someone started attacking my site a few minutes ago and its caused PHP-FPM to max out all cores (4) on my vps and NGINX is now serving 502 to all users. I'm seeing a bunch of these requests with tons ...
1
vote
3answers
146 views

Using HTTPS GET from app to server

When developing Webpages, they say you should use POST for "destructive" actions, and GET for actions that only retrieve information. Is the same true for apps? Is it a total no-no to use GET for ...
4
votes
2answers
263 views

Strange escape codes in a GET request - is this a known attack?

I recently came across some entries in nginx's access logs that resemble the following: ##.##.##.## - - [24/Sep/2014:01:21:51 -0400] "GET /767/browser-wars-side-show-ho w-natty-handles-the-load/++++++...
1
vote
0answers
209 views

Trying to GET “/iptac-xxxx” not found in nginx log. Is an attack?

I've found some messages like this one, in my nginx error.log. open() "[my-domain]/iptac-[a long long string]/http:/[my-domain]/" failed (2: No such file or directory), client: , server: , ...
0
votes
1answer
1k views

Strange flood of requests to my web server

About an hour ago, strange requests began showing up in my access logs. They are coming in at a rate of ca. 400 req/s and appear to come from IPs all over the place. It started out at a lover rate and ...
0
votes
1answer
204 views

HTTPS enable for proxy server or web server

Say I have 2 separated servers which are one web server (apache) and one proxy server (nginx), I want to use HTTPS for the website running on the Apache. Do I enable SSL on apache or nginx or both? ...
0
votes
3answers
2k views

Hardened SSL ciphers for Nginx as AWS/Cloudfront Custom Origin

Based on recommendations, we recently attempted to harden our Nginx SSL configuration against BEAST/CRIME/BREACH attacks with the following stanza: ssl_prefer_server_ciphers on; ssl_ciphers ECDHE-RSA-...
3
votes
0answers
574 views

Current State of BREACH (GZIP SSL Attack)?

It has been one year since BREACH made our way into our hearts, and there does not seem to be any articles or posts or patches since then, is my Google-fu weakening? Has BREACH been mitigated or ...
1
vote
2answers
228 views

How to prevent Cookie-Bombs?

Egor Homakov made a nice writeup (Cookie Bomb or let's break the Internet) on how to crash CDNs and other websites with cookies. Although this is a user/browser-side DOS, I'm wondering how one would ...
2
votes
2answers
749 views

PHP shellcode inside /tmp. Is the server compromised?

I have a Debian 7 VPS that runs Nginx, PHP5-FPM and MariaDB. This server runs a couple of WordPress installations, phpMyAdmin and Roundcube Webmail. One is my personal blog running WP 3.9.1 and ...
2
votes
1answer
509 views

What security does nginx provide between server blocks?

What security does nginx provide between server blocks? Here is an example scenario. Say I have two server blocks configured with nginx. Each serves up a web application to authenticated users. I am ...
1
vote
3answers
3k views

NGINX Hacking Attempt

Every time I start my test-server and let it run for some days I get this in my log-files (in different variations): 111.241.26.165 - - [18/Feb/2014:22:16:45 +0100] "\x04\x01\x00\x19\xCBER!\x00" 400 ...
1
vote
1answer
130 views

Should statically-linked server binaries (daemons) be deemed more secure? [closed]

For a long time I've pondered this question. I am aware of the benefits and downsides of dynamic libraries (shared objects), including the infamous article by Drepper. All other things being equal, ...
4
votes
1answer
188 views

Reverse Proxy SSL

I am having trouble finding out if a potential server configuration is secure. I have a server running a nginx reverse proxy that is accessible from a public ip address on the ports 80 and 443. I then ...
1
vote
4answers
253 views

How to detect credit cards harvested from memory?

Had a chat recently with PCI compliance specialist and got to realize there is a way to steal raw data from Apache / Nginx memory e.g. credit cards. It's called "harvesting" and becomes pretty common. ...
1
vote
1answer
201 views

How to avoid Heartbleed like problems in the future?

I asked a question on stackoverflow, but guess this site is better suited for it. Idea is to prevent problems when the next buffer overflow bug comes out. In my understanding the problem with ...