0
votes
0answers
20 views

How to remove malware from Debian server? [duplicate]

We have one Debian server that is affected by a malware. It's adding some code to the .htaccess files in /var/www directory where all sites are stored. Here's the malicious code: RewriteEngine on ...
0
votes
2answers
40 views

nginx as reverse proxy on front of Apache - protection and security

I'm just concerned whether to install Nginx WS alone or nginx as reverse proxy on front of Apache based on security and protection. If I had to choose nginx as reverse proxy on front of Apache, would ...
0
votes
0answers
39 views

Wordpress + nginx (post compromise), best way to block POST request for random php script?

Due to an outdated plugin, one of the domains that I host on my VPS was compromised and there were bots POSTing to //listTT9.php in order to send mail. The plugin was updated, I've gone through all ...
1
vote
1answer
119 views

unable to switch off expose_php in ubuntu 14.04 with nginx and php-fpm

According to phpinfo: Loaded Configuration File: /etc/php5/fpm/php.ini # grep expose_php /etc/php5/fpm -R /etc/php5/fpm/php.ini:expose_php = Off ...
1
vote
2answers
272 views

Why can nginx access /etc/passwd? [closed]

I'm trying to setup my new VPS with my couple sites. nginx, php-fpm and other needed services installed. I setup a nginx server block(virtual hosts) for my site, and then try to create a php file ...
25
votes
8answers
17k views

My server is still vulnerable to heartbleed even after I update OpenSSL

I have an Ubuntu 12.04 server. I have updated the OpenSSL package in order to fix the heartbleed vulnerability. But I am still vulnerable even, even though I have restarted the web server, and even ...
0
votes
0answers
90 views

Chroot master process Nginx 1.2.1

I want to install nginx not current stable version but in one currently deposits, and chroot the process. I followed some tutorials including: Securing Debian Manual Appendix H - Chroot environment ...
0
votes
1answer
123 views

Whitelisting valid URL patterns on a NGINX webserver

I want to whitelist only valid URL-patterns on our RESTful webserver / API, using regexs or something. But when googling for some examples I get a little bit suspicious since there is not much ...
-1
votes
1answer
31 views

Nginx, deny access to certain url

I have a url shortening website. The url shortening is done by PHP. I need to restrict access to certain urls. This means certain url should be blacklisted for shortening. Is there any server side ...
0
votes
1answer
46 views

Nginx: security vs conditionals

I was reading around looking for some security steps that can be taken in Nginx to protect apps I'm serving using Nginx as a reverse proxy. I found this code which has some good things in it to ...
0
votes
3answers
121 views

What compatibility trade-offs do we need to make in order to use a hardened SSL config for Nginx?

I found some hardened SSL settings in github.com/ioerror/duraconf. Here is the header from the config: This is an example of a high security, somewhat compatible SSLv3 and TLSv1 enabled HTTPS ...
1
vote
1answer
69 views

Securely configuring nginx for php

I want to use nginx for both Symfony2 sites and other software like phpMyAdmin. I've read the nginx docs on setting up Symfony2 and came across this issue: ...
0
votes
0answers
88 views

nginx hidden file deny configuration?

I am using the below standard config to block download of hidden files from nginx : #Prevent (deny) Access to Hidden Files with Nginx location ~ /\. { access_log off; ...
-1
votes
1answer
147 views

Exclude fastcgi from running php on an specific folder

Users can upload files on my webserver to a specific directory. In order to be more secure I want to exclude php-fastcgi from parsing PHP scripts in that specific directory. directory = ...
0
votes
2answers
579 views

how to enable TLSv1.1 and TLSv1.2 on nginx Debian squeeze?

For security I have to setup a nginx server with TLSv1.1 or TLS v1.2. By default, nginx configuresTLSv1. Reading the documentation I see that nginx has to set the following directive: ssl_protocols ...
5
votes
3answers
250 views

Correct way to handle security threats to web server on budget [closed]

During our annual security review I was reminded of an incident earlier this year where we received a threat to our organizations web server. It was over a organization policy and threatened to DDoS ...
-1
votes
1answer
169 views

Content Security Policy Configuration Problems

I have a server running nginx and I would like to add CSP. However I'm encountering difficulties even after following numerous guides I will either get an error from nginx or they just don't work. ...
0
votes
1answer
149 views

Sending two Content-Security-Policy headers

I current have an nginx server that is sending the Content-Security-Policy header, however I've read that apparently IE only supports "X-Content-Security-Policy". Would it be a good idea to send both ...
0
votes
2answers
124 views

SSL Certificates Throwing Errors Randomly

I purchased a cheap SSL certificate from NameCheap (GeoTrust RapidSSL, to be precise), and many users are complaining that they are getting an "Untrusted SSL certificate" error when visiting the page. ...
1
vote
1answer
285 views

How to ban web crawler using fail2ban

I am using nginx and I am always hit by web crawler if I am correct. I tried to configure fail2ban but the IP address cannot be detected by fail2ban. The reason that it is not detected because it ...
0
votes
1answer
60 views

Securing nginx (user/file permissions)?

I'm just setting up nginx on my web server, and I created a user account for it to use (nginx). However, it runs its worker processes by default as www-data. Is there any disadvantage to using ...
1
vote
1answer
43 views

Long term security risks of rarely updated nginx

We've deployed a system at a university using a stack of Postgres, Nginx and Django on (mandated) RHEL. The ITS department is now pressuring us to switch to Apache on order to benefit from regular ...
-1
votes
1answer
41 views

SSL secured account section, Subdirectory vs Subdomain [closed]

I'm currently running Drupal on an nginx server, and I also have a separate user account system running on account.domain.com. I purchased a wildcard SSL certificate to protect the login form, but the ...
0
votes
2answers
168 views

-bash: www.mydomain.com.pem: Permission denied

I have these three files in /etc/nginx/ssl folder: www.mydomain.com.csr www.mydomain.com.key www.midomain.com.key.nopass I bought and downloaded the positive ssl certs in ...
0
votes
2answers
327 views

Nginx - prevent a .php file running on anything but your own server/domain?

We have an mp3 player that runs via an iFrame, not our choice but thats how we're stuck with it. We want to prevent other people simply embedding the iframe on their site. What would be the best way ...
0
votes
1answer
723 views

Set Access-Control-Allow-Origin in nginx using wildcard domain

With nginx can I specify Access-Control-Allow-Origin using a wildcard like *.mydomain.com? Would it look like: add_header Access-Control-Allow-Origin *.mydomain.com; Thanks.
1
vote
1answer
349 views

Should I include the root CA cert when making a chained cert

I am using Godaddy cert, normally I would concat the cert and make into a chained cert cat www.example.com.crt sf_bundle.crt > chained.cert And in my nginx.conf, ssl_certificate chained.cert ...
0
votes
1answer
381 views

Nginx autoindex feature

I'm deploying some sort of file exchange based on the assumption that the files are accessible only to the person which knows the folder path on the server (ex. mydomain.tld/privatesecretfolder/). ...
1
vote
1answer
495 views

Is there a way to disable symbolic links for nginx auto-indexed directory?

I would like to configure nginx to list and serve bulk files from a select directory (autoindex on option). However I worry that if a symbolic link will be accidentally placed in such a directory, ...
0
votes
2answers
376 views

Deny loading of php files if accessed directly (nginx)

I don't know if this can be achieved... I'll try anyway. I'd like to deny php files in a certain folder to be viewable if loaded directly (you point the browser to the direct URL), but only if you ...
3
votes
2answers
1k views

How To limit Nginx Auth_Basic re-tries?

I have protected a web folder with Nginx's Auth_Basic module. The problem is, we can try several passwords until it works (brute force attacks). Is there a way to limit the number of failed re-tries?
0
votes
1answer
7k views

How To use fail2ban for Nginx? [closed]

How can I use fail2ban on an Nginx server? What are the rules to put in the jails.conf?
2
votes
1answer
836 views

How should I structure my users/groups/permissions for a web server?

How should I setup permissions in the most secure way on my dedicated server which I'm running FTP + Nginx on? I want FTP to be able to read/write files and I want Nginx to be able to read/write the ...
-2
votes
2answers
184 views

Nginx massive error.log, am I being DDOSed?

So I just opened up my Nginx error log as all my pages are throwing error code 500. It's enormous, my site is still in development and their are well over 100k errors for resources Nginx was unable ...
0
votes
1answer
72 views

Is it secure to use apache mod_mono with more virtualhosts?

I am using apache2 with mod_php and mpm_itk_module to run every virtualhost under its user. Now I am looking at mono (mod_mono) and I am not sure, if it is secure to run mono as only one process, whom ...
3
votes
3answers
903 views

Nginx equivalent to mod_security and related

I'm looking for a way to get my nginx to have reasonable abilities for auto-blocking various malicious requests. E.g. since it doesn't serve any php scripts, any request for a php URLs that script ...
0
votes
1answer
208 views

Http server security analyser and sanitizer proxy

I'm looking for software that will monitor all https request coming through our proxy server. We currently use nginx that proxies to our application servers. Ideally, the solution will sit between ...
1
vote
1answer
210 views

How can I setup my local Nginx server so I can edit the files?

I have my local development machine running Arch Linux, Nginx, PHP-FPM and MySQL. In order for the websites I am working on to run the files need to be owned by the http user. The files are currently ...
1
vote
1answer
430 views

Should Jetty always be behind another webserver (eg nginx, apache) to improve security?

For a long time I've always run nginx in front of jetty to do load balancing. However, I have a new project where I will be using HAProxy to do the load balancing and was wondering if I should have ...
0
votes
1answer
451 views

Nginx security schema with multiple users, virtual hosts and FCGI PHP

I want to configure nginx as follows: There are several registered users on the server. Every user may own several virtual hosts (they cannot configure them) of two different types: nodejs proxy or ...
6
votes
2answers
7k views

User per virtual host in Nginx

Is it possible in nginx configure different user per virtual host? Something like server { user myprojectuser myprojectgroup; ... }
0
votes
1answer
2k views

socket: Connection refused on NGINX web server

I'm trying to connect NGINX web server using Passenger for a Rails project. I've checked my configuration file, and i gave connection to sites over port 883. This is my configuration file as ...
3
votes
2answers
489 views

Ubuntu scalable nginx mongodb mongdb memcached server configuration [duplicate]

I have been building a PHP web application using the following techniques in the past 2 months: PHP 5.3.4 MongoDB MySql I just got my dedicated server running Ubuntu 10.4 LTS x64 with the ...
2
votes
1answer
148 views

who should own the web root of my server?

I read a book about security in web servers and I found this: If your web server has the ability to write to the files in your WordPress directories, then the automatic upgrade functionality ...
1
vote
0answers
577 views

Nginx, uWSGI, Python, users, groups and permissions. Questions about security

Ok, yesterday I finally get nginx and uWSGI servers running on my PC. Nginx and uWSGI configuration files, new users, groups and their privileges, and chrootdir for SSH I configured based on knowledge ...
0
votes
1answer
731 views

Nginx : Proper use of limit_req_zone and limit_req

I have 2 website running on VPS. Their purpose is sharing music files and publishing news. Both of them use wordpress. What I am trying is that I want to prevent little hackers from flooding the ...
1
vote
1answer
2k views

How can I protect files on my NGiNX server?

I am trying to protect files on my server (multiple types), with NGiNX and PHP. Basically I want people to have to sign in to the website if they want to access those static files like images. ...
2
votes
1answer
777 views

Hide/Replace Nginx Location Header?

I am trying to pass a PCI compliance test, and I'm getting a single "high risk vulnerability". The problem is described as: Information on the machine which a web server is located is sometimes ...
0
votes
1answer
767 views

Is someone trying to hack my site? How to block certain URLs in Nginx?

On the past few hours my server is getting pretty loaded, mostly due to a lot of load requests. I've seen this thanks to the StatCounter realtime stats, which shows that the "Came from" page is: ...
2
votes
2answers
270 views

Nginx: Limit access to all but php

I want to deny access to one specific folder (and all files inside of it) but I'd like that php files from inside my server could have access to it (and its files). Is it possible? This is what I am ...