Questions tagged [nginx]
nginx [engine x] is an HTTP and reverse proxy server, written by Igor Sysoev
0
votes
2answers
57 views
Security best practises for my first ever Node, Mongodb, Nginx production app on a Ubuntu VPS
So as the title says I'm just deploying my first ever app in production.
Because I don't have experience, I was told to ask someone who knows this stuff.
So how should I ensure the best security for ...
-1
votes
0answers
18 views
How to make nginx to send early data in POST method [migrated]
I am testing TLS 1.3 and 0 RTT in a local nginx web server.
It works fine with GET methods. But when I use POST methods to send early data, it does not succeed. I think the cause is the ngnix server....
-1
votes
0answers
80 views
“Content-Security-Policy” HTTP Header with “default-src 'self'; script-src 'self'” not blocking downloading of non specify domain
I am trying to only allow 'self' and 'https://cdn.jsdelivr.net' by using:
"add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://cdn.jsdelivr.net";
I encountered an ...
1
vote
1answer
80 views
Nginx: mod-security rule for http slow DoS attack
The only related rule in mod-security for slow DoS is modsecurity_crs_11_slow_dos_protection, and it's for Apache only.
Is there a rule for Nginx?
0
votes
1answer
38 views
NGINX 444 response equivalent for Apache server
How can I configure Apache HTTPD server to send no response and close connection in case of DDoS or malicious request
3
votes
1answer
121 views
I'm moving my website to a new server, what implications does this have for my SSL certificate?
I run a website which I serve over https and https only (add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";)
The ssl certificate I bought came from namecheap.com, ...
1
vote
1answer
164 views
Suspiscious HTTP request to nginx server in server log, what is it?
I have an nginx server running an instance of and express/nodejs server.
I was going through the logs to see what was being requested, and I noticed a few normal attempts for common flaws in things ...
0
votes
1answer
721 views
Help on what to do with these suspicious logs
Just set up my first linode server this last Wednesday, and today I tried to take a look on the nginx access logs, and found this suspicious logs.
47.96.15.13 - - [28/Jul/2018:14:54:05 +0800] "GET /...
2
votes
1answer
49 views
Two certificates with HSTS on different ports?
Is it possible to set up Nginx in such way, that on the same domain it will serve on two different ports, two different valid certificates both with HSTS?
Certificates are from different CA and for ...
1
vote
2answers
277 views
Should we enable TLS on backend connection after reverse proxy? [duplicate]
I have a reverse proxy (e.g. nginx, nghttpx, haproxy) that proxies connection to a service running on the same physical server. I think the most common way to configure this setup is to enable TSL ...
0
votes
0answers
69 views
Do NGINX/Apache allow URI (http/ldap) based CRL (revocation list)?
my client certificate provider has a low "validity" period for CRLs, which is of 7 days.
AFAIK, that means that I will need to update the CRL file on my web server every 6 days if I want it to work, ...
0
votes
0answers
32 views
How to maintain sensible cipher list for a public webserver [duplicate]
I'm configuring nginx and am trying to find a cipher list that gives an A standard over at SSLlabs while also allowing common browsers to access the website.
I am not an expert and am asking this ...
7
votes
2answers
189 views
What are the potential vulnerabilities of allowing a large http body size?
With NGINX and PHP I am allowing 5GB files to be 'uploaded' to my server although they will not be downloaded unless they are 'legitimate' (that is for another question ;)). I was wondering is this is ...
3
votes
1answer
173 views
How to set basic defense on Nginx-CMS?
As an Information Security amateur I did all in my might to protect my Ubuntu-Nginx-CMS (WordPress) environment from BFAs, MITMs, and database injections.
sudo add-apt-repository ppa:certbot/certbot -...
3
votes
2answers
2k views
Turned on cgi.fix_pathinfo still “dangerous” in Nginx?
In this article in digitalocean.com Justin Ellingwood recommends to turn off cgi.fix_pathinfo:
Inside, we need to find a section that configures the cgi.fix_pathinfo
behavior. It will be ...
2
votes
1answer
321 views
s_client custom ciphersuite with nginx reverse proxy fails
I have compiled openssl 1.0.1u (yes, i know its old one) with my
custom ciphersuite (ECDHE-RSA-MYCIPHER-CBC-SHA) with openssl for a
research project; it has compiled and installed successfully.
When I ...
2
votes
2answers
394 views
How to integrate client certificates for upstream servers with nginx as reverse proxy?
For my private VPS, I am building a configuration for different web applications (Owncloud,...) which depends on a combination of different Docker containers. At the front, I would like to use an ...
0
votes
1answer
623 views
Some bot keeps posting this to my server
Some bot keeps posting strings like this to my server. What do they mean and what's the best way from preventing them?
RaxfkI/...
0
votes
2answers
159 views
My own simple web server + nginx as a reverse proxy
Say I've created my own web server from scratch. Very-very simple and vulnerable. I'm going to use it in production. Despite it being vulnerable, will it be feasible to run it with nginx and configure ...
1
vote
1answer
178 views
Wordpress site hack attempt
I found some thing upnormal in my nginx server log.
74.208.235.132 - - [06/Oct/2017:03:36:20 +0000] "POST //%63%67%69%2D%62%69%6E/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%...
0
votes
1answer
458 views
Trying to do a chunked multipart post request, nginx and php both returns 400 error
I'm trying to use chunked protocol and multipart protocol in a POST request, like this
All new-line symbols are \r\n, e.g
POST http://127.0.0.1/print.php?a=1&b=2 HTTP/1.1
accept-language: *
...
0
votes
2answers
2k views
Directory traversal in a URL?
Scenario:
I have a webserver running nginx. I have my html files in /var/www/ and pictures in /var/www/pictures/
However, I also have some secret pictures in /var/www/pictures/secretpics/ which I ...
1
vote
1answer
400 views
Is using X-Real-IP as a way to check for localhost access safe?
I have an application listening on the port 5000 that can be accessed to the internet through nginx with this configuration:
upstream myapp {
server 127.0.0.1:5000;
}
server {
listen 80;
...
0
votes
1answer
93 views
Must one have SSL certificates for each domain, to use HTTPS? [duplicate]
I read in the following passage in this DigitalOcean article, concerning HTTP/2:
Even though HTTP/2 does not require encryption, developers of two most
popular browsers, Google Chrome and Mozilla ...
0
votes
1answer
3k views
CVE-2017-7529 - Exploit details? [closed]
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7529
Where can I find the exploit details for this CVE? Usually sites like exploit-db.com include the PoC exploit for a given vuln but I can't ...
1
vote
1answer
69 views
what does these unknown request_uri values against my nginx web server mean?
I built a web application with low traffic so far, after making some advertising I realized there are some suspicious requests against my server, this is what Loggly service shows me in panel:
Logs ...
12
votes
3answers
7k views
What can I do after an attack to our system that hit our login route?
This morning I checked our nginx logs.
46.x.x.90 - - [17/Jul/2017:05:51:31 +0000] "HEAD http://x.x.71.1:80/PMA2011/ HTTP/1.1" 301 0 "-" "Mozilla/5.0 Jorgee" "-"
46.x.x.90 - - [17/Jul/2017:05:51:31 +...
1
vote
1answer
129 views
What are methods against code leakage for web applications?
I like to see the server-side web application layer as independent as possible, from the OS, from the server software like (Apache, nginx, IIS, et cetera). In order to easily grab the application and ...
0
votes
1answer
83 views
Cloudflare cipher selection based on AES-NI support
How does Cloudflare selects AES ciphers on devices with AES acceleration and ChaCha on devices without it ?
2
votes
1answer
472 views
Connection timeout error using HTTP Status Code Checkers on a website [closed]
PROBLEM
When I use online tools to test www.bestbuy.com URL's, I get a timeout connection error.
By online tools I mean HTTP Status Code Checkers or Redirection Checkers.
EXPECTED BEHAVIOUR
I ...
1
vote
2answers
234 views
Value of using passphrase on private key
I am implementing HTTPS with Nginx and I generated private key with passphrase. Now I wonder what is the practice in production environment, using unprotected keys or protected with ssl_password_file ...
1
vote
0answers
354 views
user permissions and nginx with git hook for deployment
So I am trying to set up a webserver which will use nginx to serve a static site (for now). I set up a git repo that I want to push to in order to make deployment easy (using this guide: https://www....
1
vote
1answer
779 views
Is it possible to configure TLS/SSL in Nginx without persisting the private keys on disk?
When you configure TLS in Nginx via ssl_certificate and ssl_certificate_key, you have to provide the keys as files. From my understanding it is generally best practice to avoid keeping private keys ...
1
vote
1answer
315 views
Proxy not rejecting illegal host header when coming from my VM provider's network
I have a django app hosted on a linode VM, proxied by nginx on that same VM.
In my nginx config I have a block to deny bad host header requests:
## Deny illegal Host headers
if ($host !~* ^(mydomain....
0
votes
0answers
88 views
Nginx/AWS - intermittently serving someone else's site
We are using Nginx 1.10.1 as a reverse proxy, installed on ubuntu 14 from an AWS stock image.
We had a situation where one of our environments was serving up content to a different website that's not ...
0
votes
0answers
83 views
Which cipher suite should I add to allow BlackBerry 10 browsers to connect to our site via https?
Last night I've configured a client's site to redirect all requests that arrive via http to https. I have the following list of cipher suites that we support to establish a secure connection to our ...
6
votes
2answers
948 views
HTTPS and Basic Auth
I've set up an NGINX reverse proxy on my home server with dynamic DNS from my website 'stuff.mydomain.com' along with a certificate from letsencrypt. I'm using basic auth to authenticate users.
When ...
19
votes
4answers
1k views
Dealing with SSL Certificates on Products
We are developing a product (device / system) that will be installed on customer sites. Many of our customers will (should) be concerned about security, and should be thinking about it seriously.
Our ...
3
votes
1answer
332 views
Protecting web site with nginx 301 redirect and HTTP firewall
I am setting up a hobby web site and trying to make it as secure as possible. The backend is nginx + uwsgi. I have set up the HTTPS connection. For non-SSL requests, I have the following rules in ...
1
vote
1answer
154 views
HTTPoxy - What about HTTPS_PROXY when dealing with HTTPoxy vulnerability?
fastcgi_param HTTP_PROXY ""; is the soluntion, but why didn't they also mention HTTPS_PROXY? I have a HTTPS website, not HTTP.
Should I also add fastcgi_param HTTPS_PROXY ""; or not?
Stop changing ...
1
vote
1answer
1k views
XSS protection header for firefox
I have enabled XSS protection in server using nginx with below header. But After long research google chrome, IE 10 & above and safari supports that but Firefox doesnt support
add_header X-XSS-...
0
votes
1answer
354 views
Nginx fallback SSL for one domain
I have a Debian server running Nginx under a domain, and I have 2 different SSL certificates, from different authorities. Is it possible to configure Nginx in a way to serve one SSL certificate, but ...
0
votes
1answer
734 views
Nginx Form-base Authentication
I want to have nginx in front of my Tomcat and to act as a authentication gateway. So if request is not authenticated in will be redirected to login form that will also be stored on nginx. nginx will ...
2
votes
1answer
530 views
What is proxyjudge.info?
I have setup a nginx server literally an hour ago. It is open to the world but is not in production. There is no CNAME or other DNS records associated with the server's IP address yet.
In the ...
0
votes
2answers
108 views
Mediawiki/Nginx/Php on Ubuntu 14.04 is being attacked
I had a personal wiki set up with mediawiki on my server with nginx.
Recently I noticed that all my sites that used php (Mediawiki and all Wordpress sites) were not responding or timing out.
Then I ...
1
vote
0answers
414 views
nginx request redirected
I've noticed in my nginx access.log entries like this:
XX.XX.XX.XX - - [05/Jan/2017:00:21:43 +0100] "GET / HTTP/1.1" 301 178 "-" "libwww-perl/6.05"
This is weird because i've implemented GeoIP ...
0
votes
1answer
47 views
Should a webserver's access to certain directories be limited?
There was a security update to Roundcubemail today and I just patched my web/mail -server. Within the update files, there was some recommendations to restrict webserver's access to certain directories....
2
votes
0answers
2k views
Anyone can identify tool used to perform this attack?
recently I've identified that some hack attempt was performed at one of my servers.
I have dumped nginx logs to github, please take a look and try to identify which tool was used to perform this ...
0
votes
0answers
66 views
Django + NGINX + Gunicron: access project files
Is there a known security breach that enables attackers to gain access to the project files of a Django app?
One of our clients has received an email from a security expert showing that he gained ...
3
votes
3answers
600 views
Can PHP crash and expose source code?
I am running NGINX and PHP fast CGI. I have a simple PHP website witch has some credentials hardcoded inside the source code.
Will nginx serve the actual source code of the website instead of the ...
