Tag Info

Hot answers tagged

36

How do I know if my server is already compromised due to the Shellshock bug? You don't. That's the idea of a security vulnerability. If you had to click Let the crackers in? OK/Cancel it wouldn't be much of a vulnerability. You may have some luck checking the logs of your attack vectors, but given that so many services are vulnerable and not all of ...


31

There is one theoretical way of determining the DNS resolver of your clients, but it's quite advanced and I don't know any off-the-shelf software that will do that for you. You'll for sure have to run a authoritative DNS server for that in addition to your nginx. In case the HTTP Host header is incorrect, serve an error-document and include a request to a ...


21

It is not generally possible to access services, bound only to localhost, from external addresses. SF is fairly replete with questions asking how to reverse that state of affairs, and the calisthenics required to do it are non-trivial, precisely because the whole concept of binding only to localhost is designed to give you that security without more ado.


19

shellshock isn't a worm so there are no files to look for. Shellshock is a way to attack a network to gain entry. Once inside who knows what the attacker will do.


18

As google writes on this blog entry http://googleonlinesecurity.blogspot.se/2014/10/this-poodle-bites-exploiting-ssl-30.html there is three ways of mitigating POODLE: Disable SSL 3.0 support Disable CBC-mode ciphers with SSL 3.0 Support TLS_FALLBACK_SCSV The first two options breaks compatibility with old clients such as IE6 on XP. TLS_FALLBACK_SCSV ...


18

I would try a map: map $http_referer $bad_referer { default 0; "~spamdomain1.com" 1; "~spamdomain2.com" 1; "~spamdomain3.com" 1; } Then use it like so: if ($bad_referer) { return 444; }


16

content-length can't be set if the Transfer-Encoding is set to be chunked. At the time of sending the headers, the server is unaware of how much data it will finally send. Each chunk has it's own length header field (see the RFC). If you think about it, unlike with a static HTML file, the web server has no way of knowing how much data will be generated by a ...


13

It doesnt look like anything to worry about. Bittorrent trackers are just regular HTTP servers. Your server is sending 404 errors - there is no tracker on your server. Probably at some point in the past your IP address was used as a tracker, or someone else has misconfigured their client, or their tracker dns.


13

My preferred way of dealing with this is to block access to anything in the /wp-admin/ folder and /wp-login.php to everywhere except a known static IP, say the IP of your office. Barring that, look into fail2ban or any number of wordpress plugins that can handle mitigating these brute-force hacking attempts.


13

I got this working using try_files: location / { try_files "${uri}_${args}" 404.html; } This will try to find a file on disk named after the pattern you provided with a "_" instead of the "?". Further configuration depends on how you saved static files like images or stylesheets. You can add a fallback trying to read them without query string form ...


11

Since the answer is somehow hidden in the question - here is the solution for nginx in a VirtualBox environment as standalone answer. In your nginx config (usally /etc/nginx/nginx.conf) or vhost config file change the sendfile parameter to off: sendfile off;


10

Nginx client_max_body_size PHP post_max_size upload_max_filesize And restart or reload. Source: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size


10

This error occurs when the server_name is too large to fit in the hash bucket. The default for server_names_hash_bucket_size is chosen depending on the CPU cache line size of the server. In particular it's meant to be as small as possible, to reduce CPU cache misses, as server_names must be looked up on every request. As for why you're limited to 14 ...


9

DNSSec is all about cryptographically signing DNS responses from a DNS server. NGINX is a web server, not a DNS server. So to answer your question: You don't.


9

Nginx use many variables which can be used in config. This page provided the complete list of the variables. The variable that hold the protocol in HTTPS request is ssl_protocol $ssl_protocol returns the protocol of an established SSL connection; So your proxy_set_header configuration would be proxy_set_header X-HTTPS-Protocol $ssl_protocol ...


8

Those two errors was unrelated although the error message was same. [...]SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 [...] Start Time: 1411583991 Timeout : 300 (sec) Verify return code: 20 (unable to get local issuer certificate) Above error was issued openssl_client command. As explained by Florian Heigl, you get this error ...


8

By default SELinux only allows the web server to make outbound connections to a limited set of ports. # semanage port --list http_port_t tcp 80, 81, 443, 488, 8008, 8009, 8443, 9000 To fix the problem, you simply need to add your own desired port number to the list. # semanage port --add --type http_port_t --proto tcp 7777 Then ...


8

Configure it to run on any port you like! 81. 8081. Anything really.


8

I believe that this website may help you greatly: http://regex101.com/r/uP4nT1


8

Accepted answer didn't work for me on nginx/1.4.2. Setting proxy_pass to a variable forces re-resolution of the DNS names (caching it for 5 minutes), because Nginx treats variables differently to static configuration. Example: server { ... resolver 127.0.0.1; set $backend "http://dynamic.example.com:80"; proxy_pass $backend; ... } ...


8

Cloudflare's flexible ssl means the connection to your server is always over http: Given this - the only server block in the question of relevance is this one: server { listen 80; server_name example.com www.example.com; return 301 https://$server_name$request_uri; } It should be obvious why that results in a redirect loop, ...


7

The data in question does NOT need to be secure... prevent warning about mixing secure I think you should probably understand the reason for these warnings instead of just trying to ignore them as best as possible. If content on a secure site is included from a insecure site it might affect the security of the original site. The server takes on ...


7

You must create a default vhost configuration file and include it before of others. For example you can save this default config to /etc/nginx/conf/default.conf: server { listen 80 default_server; return 444; } And include it in nginx.conf: http { .... include "/etc/nginx/conf/default.conf"; include "/etc/nginx/vhosts/*.conf"; } Be sure ...


7

You can run the following tests: telnet $server_ip 443 this will tell you if there is something listening in that port telnet desktop.just4bettors.mobi 443 Trying xxx.xxx.xx.xxx... Connected to desktop.just4bettors.mobi. Escape character is '^]'. ^] telnet> q Connection closed. openssl s_client -connect $server_ip:443 -showcerts this will actually ...


7

Since Nginx 1.7.5 you can use always to add a header irrespective of the response code: add_header X-Test "blahblahblah" always;


7

Old question but the issue is because the parent location is a regex locations while the nested locations are prefix locations. When a parent location is defined by a regex, any nested locations must also be defined by regexes. location ~ /a|/b { location ~ /a { } location ~ /b { } } You may define nested regex locations ...


7

You should add wheezy-backports to your /etc/apt/sources.list: deb http://ftp.de.debian.org/debian/ wheezy-backports main contrib non-free and then on a console: aptitude update aptitude -t wheezy-backports install nginx


7

Actually you can do that via proxy_set_header. For more details look here: http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_set_header or see an example use-case here: http://stackoverflow.com/questions/12847771/configure-nginx-with-proxy-pass I have included the dynamic approach into your above posted configuration: server { listen 80; ...


7

That's what HSTS is supposed to do. Once a browser has visited the https version of a site and received the HSTS header back, it will always request the https version until the expiry date, which in your case is one year. add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; And because you have includeSubDomains, subdomains are ...


6

Add $ssl_cipher to your log_format configuration. Refer to http://nginx.org/en/docs/http/ngx_http_ssl_module.html#variables for all SSL-related variables. Example Define a custom log_format in the http context (e.g. /etc/nginx/nginx.conf): log_format combined_ssl '$remote_addr - $remote_user [$time_local] ' ...



Only top voted, non community-wiki answers of a minimum length are eligible