Tag Info

Hot answers tagged

36

How do I know if my server is already compromised due to the Shellshock bug? You don't. That's the idea of a security vulnerability. If you had to click Let the crackers in? OK/Cancel it wouldn't be much of a vulnerability. You may have some luck checking the logs of your attack vectors, but given that so many services are vulnerable and not all of ...


28

There is one theoretical way of determining the DNS resolver of your clients, but it's quite advanced and I don't know any off-the-shelf software that will do that for you. You'll for sure have to run a authoritative DNS server for that in addition to your nginx. In case the HTTP Host header is incorrect, serve an error-document and include a request to a ...


22

Ensure that the libssl1.0.0 package has been updated as well (that package contains the actual library, the openssl package contains the tools) and that all services using the library have been restarted after the upgrade. You have to RESTART all services using openssl (service apache restart).


20

It is not generally possible to access services, bound only to localhost, from external addresses. SF is fairly replete with questions asking how to reverse that state of affairs, and the calisthenics required to do it are non-trivial, precisely because the whole concept of binding only to localhost is designed to give you that security without more ado.


19

shellshock isn't a worm so there are no files to look for. Shellshock is a way to attack a network to gain entry. Once inside who knows what the attacker will do.


18

I would try a map: map $http_referer $bad_referer { default 0; "~spamdomain1.com" 1; "~spamdomain2.com" 1; "~spamdomain3.com" 1; } Then use it like so: if ($bad_referer) { return 444; }


17

As google writes on this blog entry http://googleonlinesecurity.blogspot.se/2014/10/this-poodle-bites-exploiting-ssl-30.html there is three ways of mitigating POODLE: Disable SSL 3.0 support Disable CBC-mode ciphers with SSL 3.0 Support TLS_FALLBACK_SCSV The first two options breaks compatibility with old clients such as IE6 on XP. TLS_FALLBACK_SCSV ...


14

content-length can't be set if the Transfer-Encoding is set to be chunked. At the time of sending the headers, the server is unaware of how much data it will finally send. Each chunk has it's own length header field (see the RFC). If you think about it, unlike with a static HTML file, the web server has no way of knowing how much data will be generated by a ...


13

Environment variables cannot be used in the upstream module, nor in server or location blocks. They can only be referenced in the main config, which doesn't help you. You could do this with the openresty bundle that includes Lua. If you don't want to use openresty/Lua, the only other solution is to do some substitution at container startup. Your docker run ...


13

It doesnt look like anything to worry about. Bittorrent trackers are just regular HTTP servers. Your server is sending 404 errors - there is no tracker on your server. Probably at some point in the past your IP address was used as a tracker, or someone else has misconfigured their client, or their tracker dns.


13

My preferred way of dealing with this is to block access to anything in the /wp-admin/ folder and /wp-login.php to everywhere except a known static IP, say the IP of your office. Barring that, look into fail2ban or any number of wordpress plugins that can handle mitigating these brute-force hacking attempts.


12

1) How can I remove the [warn] and avoid buffering responses? Is it better to turn off proxy_buffering or set proxy_max_temp_file_size to 0? Why? You should set proxy_max_temp_file_size to 0 in order to remove it. The proxy_buffering directive doesn't directly related to the warning, instead it can switch off buffering at all, which only needed for ...


12

The passwd file is readable by all users. This is perfectly normal. Same for /. Programs need access to /etc/passwd to map usernames to ids. The actual passwords are stored in /etc/shadow which is more restricted. If for some reason you don't want programs seeing those file you should look at creating a chroot jail which provides it with its own fake ...


10

When a process starts reading from a file, it creates a filehandle attached to the inode where the file lives. When you delete a file, you delete the link from the directory to the inode. That link will be removed immediately, so that no other process will be able to find the file. However, as long as there is an active filehandle to the inode, the ...


10

You don't. That's the simple answer, anyway -- you don't need it. uWSGI is itself a capable server. However, other servers like nginx have been around longer and are (probably, anyway) more secure, as well as having additional features not supported by uWSGI -- for example, improved handling of static resources (via any combination of Expires or E-Tag ...


9

This error occurs when the server_name is too large to fit in the hash bucket. The default for server_names_hash_bucket_size is chosen depending on the CPU cache line size of the server. In particular it's meant to be as small as possible, to reduce CPU cache misses, as server_names must be looked up on every request. As for why you're limited to 14 ...


8

I found what was the error, I needed to add proxy_ssl_session_reuse off;


8

First, you shouldn't use rootdirective inside the location block, it is a bad practice. In this case it doesn't matter though. Try adding a second location block: location ~ /some/path/(?<section>.*)/index.html { proxy_pass http://192.168.1.24/$section/index.html; proxy_set_header Host $host; } This captures the part after /some/path/ and ...


8

As a general rule when mitigating a major vulnerability in a library which is used by many programs: rebooting your server is the easiest way to ensure you've restarted every affected program, and that nothing is using the old (vulnerable) code. You should not fear rebooting your systems (you should be doing it pretty regularly when you install patches ...


8

Configure it to run on any port you like! 81. 8081. Anything really.


8

Nginx use many variables which can be used in config. This page provided the complete list of the variables. The variable that hold the protocol in HTTPS request is ssl_protocol $ssl_protocol returns the protocol of an established SSL connection; So your proxy_set_header configuration would be proxy_set_header X-HTTPS-Protocol $ssl_protocol ...


7

If you're in a development environment, you can send variables via headers. add_header X-uri "$uri"; and you'll see in your browser's response headers: X-uri:/index.php I sometimes do this during local development. It's also handy for telling you if a subsection is getting executed or not. Just sprinkle it inside your clauses to see if they're ...


7

It seems like they are trying to use your web server as an open proxy. As long as you don't see your servers responding with a 200 OK, you shouldn't be worried. UPDATE: Although there may be ways to handle this with builtin nginx functionality, I found easier to install/enable mod_security and let him handle this and other nasty attacks. As you'll see in ...


7

There's no such network as 192.168.0.1/24, because it doesn't start on a legitimate boundary between /24 network ranges. The last bit of the address is set, but is meaningless in this context. The correct address would be 192.168.0.0/24, which means the range from 192.168.0.0 to 192.168.0.255.


7

Actually, it's not client software you should be worried about. Most people run a decent browser nowadays and mobile devices are basically safe. When we tried running nginx with SNI, we discovered that some service providers were really falling behind. In one case, a certain online payments provider would just drop HTTP calls towards us because their ...


7

I believe that this website may help you greatly: http://regex101.com/r/uP4nT1


7

By default SELinux only allows the web server to make outbound connections to a limited set of ports. # semanage port --list http_port_t tcp 80, 81, 443, 488, 8008, 8009, 8443, 9000 To fix the problem, you simply need to add your own desired port number to the list. # semanage port --add --type http_port_t --proto tcp 7777 Then ...


6

I believe you can use rewrite to remove the extra part of the URL. In your case I think you could use: location /route/ { rewrite ^/route/?(.*)$ /$1 break; proxy_pass http://127.0.0.1:9000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } However ...


6

Manually running logrotate -f /etc/logrotate.d/nginx will forcefully rotate the logs configured in that file.


6

Since nginx 0.8.25 named captures can be used in server_name. You should use them. Here, the sub-domain will be stored in a variable called $sub. Then you will be able to reuse it in the rewrite directive : server { listen 80; server_name ~^(?<sub>\w+)\.olddomain\.com$; rewrite ^ $scheme://$sub.doma.in$request_uri? permanent; } Alternatively, ...



Only top voted, non community-wiki answers of a minimum length are eligible