Tag Info

Hot answers tagged

34

How do I know if my server is already compromised due to the Shellshock bug? You don't. That's the idea of a security vulnerability. If you had to click Let the crackers in? OK/Cancel it wouldn't be much of a vulnerability. You may have some luck checking the logs of your attack vectors, but given that so many services are vulnerable and not all of ...


22

Ensure that the libssl1.0.0 package has been updated as well (that package contains the actual library, the openssl package contains the tools) and that all services using the library have been restarted after the upgrade. You have to RESTART all services using openssl (service apache restart).


19

shellshock isn't a worm so there are no files to look for. Shellshock is a way to attack a network to gain entry. Once inside who knows what the attacker will do.


14

content-length can't be set if the Transfer-Encoding is set to be chunked. At the time of sending the headers, the server is unaware of how much data it will finally send. Each chunk has it's own length header field (see the RFC). If you think about it, unlike with a static HTML file, the web server has no way of knowing how much data will be generated by a ...


13

As google writes on this blog entry http://googleonlinesecurity.blogspot.se/2014/10/this-poodle-bites-exploiting-ssl-30.html there is three ways of mitigating POODLE: Disable SSL 3.0 support Disable CBC-mode ciphers with SSL 3.0 Support TLS_FALLBACK_SCSV The first two options breaks compatibility with old clients such as IE6 on XP. TLS_FALLBACK_SCSV ...


11

1) How can I remove the [warn] and avoid buffering responses? Is it better to turn off proxy_buffering or set proxy_max_temp_file_size to 0? Why? You should set proxy_max_temp_file_size to 0 in order to remove it. The proxy_buffering directive doesn't directly related to the warning, instead it can switch off buffering at all, which only needed for ...


11

The passwd file is readable by all users. This is perfectly normal. Same for /. Programs need access to /etc/passwd to map usernames to ids. The actual passwords are stored in /etc/shadow which is more restricted. If for some reason you don't want programs seeing those file you should look at creating a chroot jail which provides it with its own fake ...


10

When a process starts reading from a file, it creates a filehandle attached to the inode where the file lives. When you delete a file, you delete the link from the directory to the inode. That link will be removed immediately, so that no other process will be able to find the file. However, as long as there is an active filehandle to the inode, the ...


10

Environment variables cannot be used in the upstream module, nor in server or location blocks. They can only be referenced in the main config, which doesn't help you. You could do this with the openresty bundle that includes Lua. If you don't want to use openresty/Lua, the only other solution is to do some substitution at container startup. Your docker run ...


8

You need to split vhosts from ssl listening/configuration part: Listening part: server { listen 127.0.0.1:443 default_server ssl; server_name _; ssl_certificate /etc/ssl/wildcard.cer; ssl_certificate_key /etc/ssl/wildcard.key; } And now vhosts: server { listen 127.0.0.1:443; server_name a.example.com; root ...


8

As a general rule when mitigating a major vulnerability in a library which is used by many programs: rebooting your server is the easiest way to ensure you've restarted every affected program, and that nothing is using the old (vulnerable) code. You should not fear rebooting your systems (you should be doing it pretty regularly when you install patches ...


8

You don't. That's the simple answer, anyway -- you don't need it. uWSGI is itself a capable server. However, other servers like nginx have been around longer and are (probably, anyway) more secure, as well as having additional features not supported by uWSGI -- for example, improved handling of static resources (via any combination of Expires or E-Tag ...


8

Configure it to run on any port you like! 81. 8081. Anything really.


8

Nginx use many variables which can be used in config. This page provided the complete list of the variables. The variable that hold the protocol in HTTPS request is ssl_protocol $ssl_protocol returns the protocol of an established SSL connection; So your proxy_set_header configuration would be proxy_set_header X-HTTPS-Protocol $ssl_protocol ...


7

If you're in a development environment, you can send variables via headers. add_header X-uri "$uri"; and you'll see in your browser's response headers: X-uri:/index.php I sometimes do this during local development. It's also handy for telling you if a subsection is getting executed or not. Just sprinkle it inside your clauses to see if they're ...


7

It seems like they are trying to use your web server as an open proxy. As long as you don't see your servers responding with a 200 OK, you shouldn't be worried. UPDATE: Although there may be ways to handle this with builtin nginx functionality, I found easier to install/enable mod_security and let him handle this and other nasty attacks. As you'll see in ...


6

Where would I look to try to fix this set-up? At your backups.


6

You can include external configs via include: server { server_name example.com; listen [::]:80; listen 80; include /path/to/config1.conf; include /path/to/config2.conf; include /path/to/confdir/*.conf; } And inside separate config you can use any valid code blocks: upstream app1 { server 127.0.0.1:8080; } location ...


6

That's what HSTS is supposed to do. Once a browser has visited the https version of a site and received the HSTS header back, it will always request the https version until the expiry date, which in your case is one year. add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; And because you have includeSubDomains, subdomains are ...


6

By default SELinux only allows the web server to make outbound connections to a limited set of ports. # semanage port --list http_port_t tcp 80, 81, 443, 488, 8008, 8009, 8443, 9000 To fix the problem, you simply need to add your own desired port number to the list. # semanage port --add --type http_port_t --proto tcp 7777 Then ...


6

Add a special server for this that only listens on the local host. server { listen 127.0.0.1:80; listen [::1]:80; ... location /nginx_status { stub_status on; access_log off; allow 127.0.0.1; deny all; } }


5

For anyone else who may have arrived here looking for an answer but the accepted one didn't fit your case - I may have your solution! I didn't have a setup problem - at least not to my knowledge. I am running nginx + php5-fpm. My php.ini file was correctly configured and all my other extensions were working properly - test it with phpinfo() or php --ini. ...


5

Just create this script /usr/bin/nginx_modsite and make it executable. #!/bin/bash ## # File: # nginx_modsite # Description: # Provides a basic script to automate enabling and disabling websites found # in the default configuration directories: # /etc/nginx/sites-available and /etc/nginx/sites-enabled # For easy access to this script, ...


5

I believe you can use rewrite to remove the extra part of the URL. In your case I think you could use: location /route/ { rewrite ^/route/?(.*)$ /$1 break; proxy_pass http://127.0.0.1:9000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } However ...


5

Direct quote from http://wiki.nginx.org/Pitfalls#Taxing_Rewrites By using the return directive we can completely avoid evaluation of regular expression. Please use return instead of rewrite for permanent redirects. Here's my approach to this use-case... location = /content/unique-page-name { return 301 /new-name/unique-page-name; }


5

Let me guess, this is how you made your symbolic link: dystroy@server:/etc/nginx$ ln -s sites-available/dystroy.org sites-enabled/ Well, this creates a wrong symbolic link. As you can see in this image with colors enabled, the symbolic link doesn't point to an existing path. For simplicity, use absolute paths. dystroy@server:/etc/nginx$ ln -s ...


5

There's no such network as 192.168.0.1/24, because it doesn't start on a legitimate boundary between /24 network ranges. The last bit of the address is set, but is meaningless in this context. The correct address would be 192.168.0.0/24, which means the range from 192.168.0.0 to 192.168.0.255.


5

I think you should have bought the certificate for www.myapp.com, then you would have received a certificate for both myapp.com and www.myapp.com. A wildcard certificate is not necessary.


5

Manually running logrotate -f /etc/logrotate.d/nginx will forcefully rotate the logs configured in that file.


5

Actually, it's not client software you should be worried about. Most people run a decent browser nowadays and mobile devices are basically safe. When we tried running nginx with SNI, we discovered that some service providers were really falling behind. In one case, a certain online payments provider would just drop HTTP calls towards us because their ...



Only top voted, non community-wiki answers of a minimum length are eligible