nginx [engine x] is an HTTP and reverse proxy server, written by Igor Sysoev

learn more… | top users | synonyms

27
votes
6answers
11k views

Trying to make a Django-based site use HTTPS-only, not sure if it's secure?

The EFF recommends using HTTPS everywhere on your site, and I'm sure this site would agree. When I asked a question about using Django to implement HTTPS on my login page, that was certainly the ...
10
votes
3answers
13k views

Strange requests to web server

I have a Linode VPS running Nginx, which currently serves only static content. Once I was looking at the log and noticed some strange requests: XXX.193.171.202 - - [07/Aug/2013:14:04:36 +0400] "GET ...
5
votes
2answers
1k views

What are the dangers of storing webserver temp files in the /tmp/ folder?

I have configured my first publicly accessible nginx server. I have configured it to use a /tmp/nginx folder to store temp files. This includes the body of http requests, proxy files etc. The /tmp ...
4
votes
7answers
2k views

Server compromised for 2nd time, cannot locate source of attack

I need some help tracing a vulnerability on my server. For the second time, my server has been compromised with files being replaced with virus-ridden downloads. According to the filesystem dates, ...
4
votes
1answer
352 views

PFS on nginx: only RC4 gets used (TLS_ECDHE_RSA_WITH_RC4_128_SHA)

I'm trying to configure my webserver for perfect forward secrecy. I'm using ssl_ciphers ...
4
votes
1answer
405 views

Is every hash format that nginx accepts for HTTP Basic Auth weak against brute force?

According to http://nginx.org/en/docs/http/ngx_http_auth_basic_module.html nginx can read password hashes of these types: crypt(), apr1, SHA1 & SSHA. This is how I understand how these hashes ...
3
votes
1answer
3k views

My web server is hit by strange traffic, what is that?

I'm a noob and just set-up a linode account to play around with linux development. I started nginx and made a simple homepage for my domain (giuliopizzini.com). Today I checked the nginx logs and ...
3
votes
2answers
586 views

Restarting nginx with Jenkins or Phing - is it safe to allow Jenkins to run sudo without prompt for password

I am implementing the recommendations from Integrating PHP projects with Jenkins for my own PHP projects. I have created a jenkins user in my ubuntu 12.10 server. I used Phing as my build tool and I ...
2
votes
2answers
777 views

What approach would you choose to defend againt DDoS attacks from Nginx level?

I use Nginx compiled with the Naxsi module to protect against some vulnerabilities (SQL injection and cross-site scripting). Now I need to apply a layer of poor man's DDoS protection at this level. I ...
1
vote
4answers
479 views

nginx recommended ssl_ciphers for security, compatibility - with PFS

I'm currently using nginx with the following ciphers: ssl_ciphers HIGH:!aNULL:!eNULL:!LOW:!ADH:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS; I would like to maintain compatibility to older ...
1
vote
2answers
431 views

Generating session CSRF token based on SSL session ID

Following situation: Application is only accessible via HTTPS/SPDY nginx is sending the SSL session ID to the upstream server Upon session start I'd like to use the first 128 characters of that ...
1
vote
2answers
102 views

Using HTTPS GET from app to server

When developing Webpages, they say you should use POST for "destructive" actions, and GET for actions that only retrieve information. Is the same true for apps? Is it a total no-no to use GET for ...
1
vote
1answer
149 views

How to deny shell execution in all sub-directories?

I want nginx to deny users who have folders inside /webroot/uploads e.g. /webroot/uploads/user1 /webroot/uploads/user2 /webroot/uploads/user999 to execute any shell (php, pl, py, binary). The ...
1
vote
0answers
152 views

blueimp jQuery-File-Upload getting PHP Hacked

I really like this upload package and want to use it, but from the time I set it up on my server, I've been hacked twice by something called the AnonGhost virus (anonghost.com). I tracked the ...
0
votes
2answers
230 views

NGINX Hacking Attempt

Every time I start my test-server and let it run for some days I get this in my log-files (in different variations): 111.241.26.165 - - [18/Feb/2014:22:16:45 +0100] "\x04\x01\x00\x19\xCBER!\x00" 400 ...
0
votes
2answers
1k views

Hardened SSL ciphers for Nginx as AWS/Cloudfront Custom Origin

Based on recommendations, we recently attempted to harden our Nginx SSL configuration against BEAST/CRIME/BREACH attacks with the following stanza: ssl_prefer_server_ciphers on; ssl_ciphers ...
0
votes
0answers
25 views

nginx - How to prevent processing requests with undefined server names with HTTPS

How do I avoid nginx processing a request with an undefined server name using the https protocol. The following configuration makes this work for http requests: server { listen 80; ...
0
votes
2answers
142 views

Guarding against XSS when setting Cookies based on URI?

I have a web-site written in nginx.conf — http://mdoc.su/ — which essentially accepts two parameters, an operating system and a manual page name, and does a redirect to a different site based on the ...