Tag Info

Hot answers tagged

36

How do I know if my server is already compromised due to the Shellshock bug? You don't. That's the idea of a security vulnerability. If you had to click Let the crackers in? OK/Cancel it wouldn't be much of a vulnerability. You may have some luck checking the logs of your attack vectors, but given that so many services are vulnerable and not all of ...


31

There is one theoretical way of determining the DNS resolver of your clients, but it's quite advanced and I don't know any off-the-shelf software that will do that for you. You'll for sure have to run a authoritative DNS server for that in addition to your nginx. In case the HTTP Host header is incorrect, serve an error-document and include a request to a ...


23

I would try a map: map $http_referer $bad_referer { default 0; "~spamdomain1.com" 1; "~spamdomain2.com" 1; "~spamdomain3.com" 1; } Then use it like so: if ($bad_referer) { return 444; }


23

IPv6/IPv4 preference is determined by the initiator of a connection, i.e. the web browser. The address selection rules are defined in RFC 6724. While these can be overridden, it is only by the user reconfiguring their operating system. The only way you can force someone to use IPv4 is to not offer IPv6 at all. Obviously this is not a practical solution even ...


21

It is not generally possible to access services, bound only to localhost, from external addresses. SF is fairly replete with questions asking how to reverse that state of affairs, and the calisthenics required to do it are non-trivial, precisely because the whole concept of binding only to localhost is designed to give you that security without more ado.


20

As google writes on this blog entry http://googleonlinesecurity.blogspot.se/2014/10/this-poodle-bites-exploiting-ssl-30.html there is three ways of mitigating POODLE: Disable SSL 3.0 support Disable CBC-mode ciphers with SSL 3.0 Support TLS_FALLBACK_SCSV The first two options breaks compatibility with old clients such as IE6 on XP. TLS_FALLBACK_SCSV ...


19

shellshock isn't a worm so there are no files to look for. Shellshock is a way to attack a network to gain entry. Once inside who knows what the attacker will do.


18

Since the answer is somehow hidden in the question - here is the solution for nginx in a VirtualBox environment as standalone answer. In your nginx config (usally /etc/nginx/nginx.conf) or vhost config file change the sendfile parameter to off: sendfile off;


16

content-length can't be set if the Transfer-Encoding is set to be chunked. At the time of sending the headers, the server is unaware of how much data it will finally send. Each chunk has it's own length header field (see the RFC). If you think about it, unlike with a static HTML file, the web server has no way of knowing how much data will be generated by a ...


14

It doesnt look like anything to worry about. Bittorrent trackers are just regular HTTP servers. Your server is sending 404 errors - there is no tracker on your server. Probably at some point in the past your IP address was used as a tracker, or someone else has misconfigured their client, or their tracker dns.


13

My preferred way of dealing with this is to block access to anything in the /wp-admin/ folder and /wp-login.php to everywhere except a known static IP, say the IP of your office. Barring that, look into fail2ban or any number of wordpress plugins that can handle mitigating these brute-force hacking attempts.


13

Such preferences can be expressed using SRV records. Unfortunately those are not supported for HTTP. So you are left with a situation where the client alone is making the choice between IPv4 and IPv6. Many clients use the roundtrip time of SYN + SYN-ACK to decide which of the two to use. So by slowing down the sending of a SYN-ACK packet on IPv6, you can ...


13

I got this working using try_files: location / { try_files "${uri}_${args}" 404.html; } This will try to find a file on disk named after the pattern you provided with a "_" instead of the "?". Further configuration depends on how you saved static files like images or stylesheets. You can add a fallback trying to read them without query string form ...


11

By default SELinux only allows the web server to make outbound connections to a limited set of ports. # semanage port --list http_port_t tcp 80, 81, 443, 488, 8008, 8009, 8443, 9000 To fix the problem, you simply need to add your own desired port number to the list. # semanage port --add --type http_port_t --proto tcp 7777 Then ...


10

Nginx use many variables which can be used in config. This page provided the complete list of the variables. The variable that hold the protocol in HTTPS request is ssl_protocol $ssl_protocol returns the protocol of an established SSL connection; So your proxy_set_header configuration would be proxy_set_header X-HTTPS-Protocol $ssl_protocol ...


10

Since Nginx 1.7.5 you can use always to add a header irrespective of the response code: add_header X-Test "blahblahblah" always;


10

Old question but the issue is because the parent location is a regex locations while the nested locations are prefix locations. When a parent location is defined by a regex, any nested locations must also be defined by regexes. location ~ /a|/b { location ~ /a { } location ~ /b { } } You may define nested regex locations ...


10

This error occurs when the server_name is too large to fit in the hash bucket. The default for server_names_hash_bucket_size is chosen depending on the CPU cache line size of the server. In particular it's meant to be as small as possible, to reduce CPU cache misses, as server_names must be looked up on every request. As for why you're limited to 14 ...


10

There are couple of ways to achieve HA of a Load Balancer - or in that regards any service. Lets assume you have two machines, with IP addresses: 192.168.100.101 192.168.100.102 Users connect to an IP, so what you want to do is separate IP from specific box - eg create virtual IP. That IP will be 192.168.100.100. Now, you can choose HA service which ...


9

DNSSec is all about cryptographically signing DNS responses from a DNS server. NGINX is a web server, not a DNS server. So to answer your question: You don't.


9

Those two errors was unrelated although the error message was same. [...]SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 [...] Start Time: 1411583991 Timeout : 300 (sec) Verify return code: 20 (unable to get local issuer certificate) Above error was issued openssl_client command. As explained by Florian Heigl, you get this error ...


8

Bah, I finally found the answer after a long time digging. The problem, in my case wasn't that logrotate was failing. That error message is fine, and doesn't actually stop logrotate. The problem was that nginx was not releasing the file handle to the log file upon receiving the -USR1 signal from kill. Long story short, the reason it was not reloading the log ...


8

Define a default_server that returns an HTTP 444 code: server { listen 80 default_server; server_name _; return 444; } (Returning a 4xx error code means requests can be interpreted by a client as an unsuccessful request, rather an HTTP 200 Blank Page But Totally Worked Trust Me.)


8

Cloudflare's flexible ssl means the connection to your server is always over http: Given this - the only server block in the question of relevance is this one: server { listen 80; server_name example.com www.example.com; return 301 https://$server_name$request_uri; } It should be obvious why that results in a redirect loop, ...


8

The data in question does NOT need to be secure... prevent warning about mixing secure I think you should probably understand the reason for these warnings instead of just trying to ignore them as best as possible. If content on a secure site is included from a insecure site it might affect the security of the original site. The server takes on ...


7

You must create a default vhost configuration file and include it before of others. For example you can save this default config to /etc/nginx/conf/default.conf: server { listen 80 default_server; return 444; } And include it in nginx.conf: http { .... include "/etc/nginx/conf/default.conf"; include "/etc/nginx/vhosts/*.conf"; } Be sure ...


7

You can run the following tests: telnet $server_ip 443 this will tell you if there is something listening in that port telnet desktop.just4bettors.mobi 443 Trying xxx.xxx.xx.xxx... Connected to desktop.just4bettors.mobi. Escape character is '^]'. ^] telnet> q Connection closed. openssl s_client -connect $server_ip:443 -showcerts this will actually ...


7

You should almost always use $host, as it's the only one guaranteed to have something sensible regardless of how the user-agent behaves, unless you specifically need the semantics of one of the other variables. The difference is explained in the nginx documentation: $host contains "in this order of precedence: host name from the request line, or host name ...


7

All other answers are pre-2010, hence adding an updated comparison. Nginx A full web server, other features can also be used. Eg: HTTP Compression SSL Support Very light weight as Nginx was designed to be light from the start. Near Varnish caching performance Close to HAProxy load balancing performance Varnish best for complex caching scenarios and ...


7

That probably is about the only reason you would use the former construct, these days. The reason you're seeing this is probably that the default of ipv6only changed in nginx 1.3.4. Prior to that, it defaulted to off; in newer versions it defaults to on. This happens to interact with the IPV6_V6ONLY socket option on Linux, and similar options on other ...



Only top voted, non community-wiki answers of a minimum length are eligible