Tag Info

Hot answers tagged

36

How do I know if my server is already compromised due to the Shellshock bug? You don't. That's the idea of a security vulnerability. If you had to click Let the crackers in? OK/Cancel it wouldn't be much of a vulnerability. You may have some luck checking the logs of your attack vectors, but given that so many services are vulnerable and not all of ...


29

There is one theoretical way of determining the DNS resolver of your clients, but it's quite advanced and I don't know any off-the-shelf software that will do that for you. You'll for sure have to run a authoritative DNS server for that in addition to your nginx. In case the HTTP Host header is incorrect, serve an error-document and include a request to a ...


22

Ensure that the libssl1.0.0 package has been updated as well (that package contains the actual library, the openssl package contains the tools) and that all services using the library have been restarted after the upgrade. You have to RESTART all services using openssl (service apache restart).


21

It is not generally possible to access services, bound only to localhost, from external addresses. SF is fairly replete with questions asking how to reverse that state of affairs, and the calisthenics required to do it are non-trivial, precisely because the whole concept of binding only to localhost is designed to give you that security without more ado.


19

shellshock isn't a worm so there are no files to look for. Shellshock is a way to attack a network to gain entry. Once inside who knows what the attacker will do.


18

I would try a map: map $http_referer $bad_referer { default 0; "~spamdomain1.com" 1; "~spamdomain2.com" 1; "~spamdomain3.com" 1; } Then use it like so: if ($bad_referer) { return 444; }


17

As google writes on this blog entry http://googleonlinesecurity.blogspot.se/2014/10/this-poodle-bites-exploiting-ssl-30.html there is three ways of mitigating POODLE: Disable SSL 3.0 support Disable CBC-mode ciphers with SSL 3.0 Support TLS_FALLBACK_SCSV The first two options breaks compatibility with old clients such as IE6 on XP. TLS_FALLBACK_SCSV ...


16

1) How can I remove the [warn] and avoid buffering responses? Is it better to turn off proxy_buffering or set proxy_max_temp_file_size to 0? Why? You should set proxy_max_temp_file_size to 0 in order to remove it. The proxy_buffering directive doesn't directly related to the warning, instead it can switch off buffering at all, which only needed for ...


14

Environment variables cannot be used in the upstream module, nor in server or location blocks. They can only be referenced in the main config, which doesn't help you. You could do this with the openresty bundle that includes Lua. If you don't want to use openresty/Lua, the only other solution is to do some substitution at container startup. Your docker run ...


14

content-length can't be set if the Transfer-Encoding is set to be chunked. At the time of sending the headers, the server is unaware of how much data it will finally send. Each chunk has it's own length header field (see the RFC). If you think about it, unlike with a static HTML file, the web server has no way of knowing how much data will be generated by a ...


13

It doesnt look like anything to worry about. Bittorrent trackers are just regular HTTP servers. Your server is sending 404 errors - there is no tracker on your server. Probably at some point in the past your IP address was used as a tracker, or someone else has misconfigured their client, or their tracker dns.


13

My preferred way of dealing with this is to block access to anything in the /wp-admin/ folder and /wp-login.php to everywhere except a known static IP, say the IP of your office. Barring that, look into fail2ban or any number of wordpress plugins that can handle mitigating these brute-force hacking attempts.


12

The passwd file is readable by all users. This is perfectly normal. Same for /. Programs need access to /etc/passwd to map usernames to ids. The actual passwords are stored in /etc/shadow which is more restricted. If for some reason you don't want programs seeing those file you should look at creating a chroot jail which provides it with its own fake ...


10

First, you shouldn't use rootdirective inside the location block, it is a bad practice. In this case it doesn't matter though. Try adding a second location block: location ~ /some/path/(?<section>.*)/index.html { proxy_pass http://192.168.1.24/$section/index.html; proxy_set_header Host $host; } This captures the part after /some/path/ and ...


10

You don't. That's the simple answer, anyway -- you don't need it. uWSGI is itself a capable server. However, other servers like nginx have been around longer and are (probably, anyway) more secure, as well as having additional features not supported by uWSGI -- for example, improved handling of static resources (via any combination of Expires or E-Tag ...


10

This error occurs when the server_name is too large to fit in the hash bucket. The default for server_names_hash_bucket_size is chosen depending on the CPU cache line size of the server. In particular it's meant to be as small as possible, to reduce CPU cache misses, as server_names must be looked up on every request. As for why you're limited to 14 ...


9

DNSSec is all about cryptographically signing DNS responses from a DNS server. NGINX is a web server, not a DNS server. So to answer your question: You don't.


8

If you're in a development environment, you can send variables via headers. add_header X-uri "$uri"; and you'll see in your browser's response headers: X-uri:/index.php I sometimes do this during local development. It's also handy for telling you if a subsection is getting executed or not. Just sprinkle it inside your clauses to see if they're ...


8

I found what was the error, I needed to add proxy_ssl_session_reuse off;


8

You should use URI part in proxy_pass directive. Also, you mixed up order arguments of proxy_redirect directive, and probably you don't need it at all. Nginx has reasonable default for this directive. In this case your location block could be really simple: location /some/path/ { proxy_pass http://192.168.1.24/; # note this slash -----------^ ...


8

As a general rule when mitigating a major vulnerability in a library which is used by many programs: rebooting your server is the easiest way to ensure you've restarted every affected program, and that nothing is using the old (vulnerable) code. You should not fear rebooting your systems (you should be doing it pretty regularly when you install patches ...


8

I believe that this website may help you greatly: http://regex101.com/r/uP4nT1


8

Configure it to run on any port you like! 81. 8081. Anything really.


8

Nginx use many variables which can be used in config. This page provided the complete list of the variables. The variable that hold the protocol in HTTPS request is ssl_protocol $ssl_protocol returns the protocol of an established SSL connection; So your proxy_set_header configuration would be proxy_set_header X-HTTPS-Protocol $ssl_protocol ...


7

Since the answer is somehow hidden in the question - here is the solution for nginx in a VirtualBox environment as standalone answer. In your nginx config (usally /etc/nginx/nginx.conf) or vhost config file change the sendfile parameter to off: sendfile off;


7

Actually, it's not client software you should be worried about. Most people run a decent browser nowadays and mobile devices are basically safe. When we tried running nginx with SNI, we discovered that some service providers were really falling behind. In one case, a certain online payments provider would just drop HTTP calls towards us because their ...


7

You should add wheezy-backports to your /etc/apt/sources.list: deb http://ftp.de.debian.org/debian/ wheezy-backports main contrib non-free and then on a console: aptitude update aptitude -t wheezy-backports install nginx


7

Those two errors was unrelated although the error message was same. [...]SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 [...] Start Time: 1411583991 Timeout : 300 (sec) Verify return code: 20 (unable to get local issuer certificate) Above error was issued openssl_client command. As explained by Florian Heigl, you get this error ...


7

By default SELinux only allows the web server to make outbound connections to a limited set of ports. # semanage port --list http_port_t tcp 80, 81, 443, 488, 8008, 8009, 8443, 9000 To fix the problem, you simply need to add your own desired port number to the list. # semanage port --add --type http_port_t --proto tcp 7777 Then ...


6

Accepted answer didn't work for me on nginx/1.4.2. Setting proxy_pass to a variable forces re-resolution of the DNS names, because Nginx treats variables differently to static configuration. Example: server { ... resolver 127.0.0.1; set $backend "http://dynamic.example.com:80"; proxy_pass $backend; ... } Note: A resolver (e.g. the ...



Only top voted, non community-wiki answers of a minimum length are eligible