Im considering using this nginx module https://github.com/leev/ngx_http_geoip2_module to get the Information from which Country the IP is. My question is since im compiling the module by myself, how secure is it if i'm not keeping up with the current version. I'm not a specialist here, so if i'm having an outdated module is it maybe a security risk for the machine or is it not that important since it is an "internal" module which only reads the contents of the maxmind database? The database is on the server itself.
1
-
1Why not just do it at the application level? That will be much easier to change in the future. If you have to rebuild the web server to update the module, then you will do it less often and will also have to worry about downtime. Application updates are much easier and downtime is not usually a concern. There are definitely plenty of ways to lookup country from IP in any application– Conor ManconeJul 22, 2020 at 12:05
Add a comment
|
1 Answer
There's nothing bad in that as long as you're subscribed to any security updates list and keep an eye on vulnerabilities.
Also, do subscribe to this module future releases: if you see any mentions of CVEs or fixed bugs, you may want to upgrade.
answered Jul 22, 2020 at 10:31
