Tag Info

Hot answers tagged

36

How do I know if my server is already compromised due to the Shellshock bug? You don't. That's the idea of a security vulnerability. If you had to click Let the crackers in? OK/Cancel it wouldn't be much of a vulnerability. You may have some luck checking the logs of your attack vectors, but given that so many services are vulnerable and not all of ...


32

There is one theoretical way of determining the DNS resolver of your clients, but it's quite advanced and I don't know any off-the-shelf software that will do that for you. You'll for sure have to run a authoritative DNS server for that in addition to your nginx. In case the HTTP Host header is incorrect, serve an error-document and include a request to a ...


21

It is not generally possible to access services, bound only to localhost, from external addresses. SF is fairly replete with questions asking how to reverse that state of affairs, and the calisthenics required to do it are non-trivial, precisely because the whole concept of binding only to localhost is designed to give you that security without more ado.


19

I would try a map: map $http_referer $bad_referer { default 0; "~spamdomain1.com" 1; "~spamdomain2.com" 1; "~spamdomain3.com" 1; } Then use it like so: if ($bad_referer) { return 444; }


19

shellshock isn't a worm so there are no files to look for. Shellshock is a way to attack a network to gain entry. Once inside who knows what the attacker will do.


18

As google writes on this blog entry http://googleonlinesecurity.blogspot.se/2014/10/this-poodle-bites-exploiting-ssl-30.html there is three ways of mitigating POODLE: Disable SSL 3.0 support Disable CBC-mode ciphers with SSL 3.0 Support TLS_FALLBACK_SCSV The first two options breaks compatibility with old clients such as IE6 on XP. TLS_FALLBACK_SCSV ...


16

content-length can't be set if the Transfer-Encoding is set to be chunked. At the time of sending the headers, the server is unaware of how much data it will finally send. Each chunk has it's own length header field (see the RFC). If you think about it, unlike with a static HTML file, the web server has no way of knowing how much data will be generated by a ...


14

Since the answer is somehow hidden in the question - here is the solution for nginx in a VirtualBox environment as standalone answer. In your nginx config (usally /etc/nginx/nginx.conf) or vhost config file change the sendfile parameter to off: sendfile off;


13

My preferred way of dealing with this is to block access to anything in the /wp-admin/ folder and /wp-login.php to everywhere except a known static IP, say the IP of your office. Barring that, look into fail2ban or any number of wordpress plugins that can handle mitigating these brute-force hacking attempts.


13

It doesnt look like anything to worry about. Bittorrent trackers are just regular HTTP servers. Your server is sending 404 errors - there is no tracker on your server. Probably at some point in the past your IP address was used as a tracker, or someone else has misconfigured their client, or their tracker dns.


13

I got this working using try_files: location / { try_files "${uri}_${args}" 404.html; } This will try to find a file on disk named after the pattern you provided with a "_" instead of the "?". Further configuration depends on how you saved static files like images or stylesheets. You can add a fallback trying to read them without query string form ...


11

Nginx client_max_body_size PHP post_max_size upload_max_filesize And restart or reload. Source: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size


10

By default SELinux only allows the web server to make outbound connections to a limited set of ports. # semanage port --list http_port_t tcp 80, 81, 443, 488, 8008, 8009, 8443, 9000 To fix the problem, you simply need to add your own desired port number to the list. # semanage port --add --type http_port_t --proto tcp 7777 Then ...


10

This error occurs when the server_name is too large to fit in the hash bucket. The default for server_names_hash_bucket_size is chosen depending on the CPU cache line size of the server. In particular it's meant to be as small as possible, to reduce CPU cache misses, as server_names must be looked up on every request. As for why you're limited to 14 ...


10

There are couple of ways to achieve HA of a Load Balancer - or in that regards any service. Lets assume you have two machines, with IP addresses: 192.168.100.101 192.168.100.102 Users connect to an IP, so what you want to do is separate IP from specific box - eg create virtual IP. That IP will be 192.168.100.100. Now, you can choose HA service which ...


9

DNSSec is all about cryptographically signing DNS responses from a DNS server. NGINX is a web server, not a DNS server. So to answer your question: You don't.


9

Nginx use many variables which can be used in config. This page provided the complete list of the variables. The variable that hold the protocol in HTTPS request is ssl_protocol $ssl_protocol returns the protocol of an established SSL connection; So your proxy_set_header configuration would be proxy_set_header X-HTTPS-Protocol $ssl_protocol ...


8

Those two errors was unrelated although the error message was same. [...]SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 [...] Start Time: 1411583991 Timeout : 300 (sec) Verify return code: 20 (unable to get local issuer certificate) Above error was issued openssl_client command. As explained by Florian Heigl, you get this error ...


8

That's what HSTS is supposed to do. Once a browser has visited the https version of a site and received the HSTS header back, it will always request the https version until the expiry date, which in your case is one year. add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; And because you have includeSubDomains, subdomains are ...


8

Configure it to run on any port you like! 81. 8081. Anything really.


8

Old question but the issue is because the parent location is a regex locations while the nested locations are prefix locations. When a parent location is defined by a regex, any nested locations must also be defined by regexes. location ~ /a|/b { location ~ /a { } location ~ /b { } } You may define nested regex locations ...


8

I believe that this website may help you greatly: http://regex101.com/r/uP4nT1


8

Cloudflare's flexible ssl means the connection to your server is always over http: Given this - the only server block in the question of relevance is this one: server { listen 80; server_name example.com www.example.com; return 301 https://$server_name$request_uri; } It should be obvious why that results in a redirect loop, ...


7

The data in question does NOT need to be secure... prevent warning about mixing secure I think you should probably understand the reason for these warnings instead of just trying to ignore them as best as possible. If content on a secure site is included from a insecure site it might affect the security of the original site. The server takes on ...


7

You must create a default vhost configuration file and include it before of others. For example you can save this default config to /etc/nginx/conf/default.conf: server { listen 80 default_server; return 444; } And include it in nginx.conf: http { .... include "/etc/nginx/conf/default.conf"; include "/etc/nginx/vhosts/*.conf"; } Be sure ...


7

You can run the following tests: telnet $server_ip 443 this will tell you if there is something listening in that port telnet desktop.just4bettors.mobi 443 Trying xxx.xxx.xx.xxx... Connected to desktop.just4bettors.mobi. Escape character is '^]'. ^] telnet> q Connection closed. openssl s_client -connect $server_ip:443 -showcerts this will actually ...


7

Since Nginx 1.7.5 you can use always to add a header irrespective of the response code: add_header X-Test "blahblahblah" always;


6

You can include external configs via include: server { server_name example.com; listen [::]:80; listen 80; include /path/to/config1.conf; include /path/to/config2.conf; include /path/to/confdir/*.conf; } And inside separate config you can use any valid code blocks: upstream app1 { server 127.0.0.1:8080; } location ...


6

Where would I look to try to fix this set-up? At your backups.


6

This is an example of a well known proxy abuse exploit. Some versions of Apache (which have the proxy module installed) are often are left improperly configured or not secured, and allow anybody to route a request through your webserver, in effect, turning it into an unwitting and illicit proxy server (which could be used in an unpleasant attack). Although ...



Only top voted, non community-wiki answers of a minimum length are eligible