Security configuration in the nginx server, nginx Server Configuration

Security configuration in the nginx server, nginx Server Configuration
1. Disable SELinux

SELinux is a Linux kernel function that provides security policy protection mechanisms that support access control.

However, the additional security and complexity brought by SELinux are not proportional and cost-effective.

Sed-I/SELINUX = enforcing/SELINUX = disabled/etc/selinux/config/usr/sbin/sestatus-v # view the status

2. allow Least Privilege through partition mounting

The nginx directory on the server is partitioned separately. For example, create a new partition/dev/sda5 (first logical partition) and mount it to/nginx. Ensure that/nginx is attached with the permissions of noexec, nodev and nosetuid.

The following is my/etc/fstab Mount/nginx information: LABEL =/nginx ext3 defaults, nosuid, noexec, nodev 1 2

Note: You need to use the fdisk and mkfs. ext3 commands to create a new partition.

3. Configure/etc/sysctl. conf to enhance Linux security

You can control and configure Linux kernel and network settings by editing/etc/sysctl. conf.

# Avoid a smurf attacknet.ipv4.icmp_echo_ignore_broadcasts = 1# Turn on protection for bad icmp error messagesnet.ipv4.icmp_ignore_bogus_error_responses = 1# Turn on syncookies for SYN flood attack protectionnet.ipv4.tcp_syncookies = 1# Turn on and log spoofed, source routed, and redirect packetsnet.ipv4.conf.all.log_martians = 1net.ipv4.conf.default.log_martians = 1# No source routed packets herenet.ipv4.conf.all.accept_source_route = 0net.ipv4.conf.default.accept_source_route = 0# Turn on reverse path filteringnet.ipv4.conf.all.rp_filter = 1net.ipv4.conf.default.rp_filter = 1# Make sure no one can alter the routing tablesnet.ipv4.conf.all.accept_redirects = 0net.ipv4.conf.default.accept_redirects = 0net.ipv4.conf.all.secure_redirects = 0net.ipv4.conf.default.secure_redirects = 0# Don’t act as a routernet.ipv4.ip_forward = 0net.ipv4.conf.all.send_redirects = 0net.ipv4.conf.default.send_redirects = 0# Turn on execshildkernel.exec-shield = 1kernel.randomize_va_space = 1# Tuen IPv6net.ipv6.conf.default.router_solicitations = 0net.ipv6.conf.default.accept_ra_rtr_pref = 0net.ipv6.conf.default.accept_ra_pinfo = 0net.ipv6.conf.default.accept_ra_defrtr = 0net.ipv6.conf.default.autoconf = 0net.ipv6.conf.default.dad_transmits = 0net.ipv6.conf.default.max_addresses = 1# Optimization for port usefor LBs# Increase system file descriptor limitfs.file-max = 65535# Allow for more PIDs (to reduce rollover problems); may break some programs 32768kernel.pid_max = 65536# Increase system IP port limitsnet.ipv4.ip_local_port_range = 2000 65000# Increase TCP max buffer size setable using setsockopt()net.ipv4.tcp_rmem = 4096 87380 8388608net.ipv4.tcp_wmem = 4096 87380 8388608# Increase Linux auto tuning TCP buffer limits# min, default, and max number of bytes to use# set max to at least 4MB, or higher if you use very high BDP paths# Tcp Windows etcnet.core.rmem_max = 8388608net.core.wmem_max = 8388608net.core.netdev_max_backlog = 5000net.ipv4.tcp_window_scaling = 1

4. Delete all unwanted Nginx modules

You need to minimize the number of modules by directly compiling the Nginx source code. Minimize the risk of allowing only web servers to access modules. You can configure and install only the modules required by nginx. For example, to disable the SSL and autoindex modules, you can run the following command:

./configure –without-http_autoindex_module –without-http_ssi_modulemake && make install

Change the nginx version name and edit the file/http/ngx_http_header_filter_module.c:

Vim src/http/ngx_http_header_filter_module.cstatic char ngx_http_server_string [] = "Server: nginx" CRLF; static char ngx_http_server_full_string [] = "Server:" NGINX_VER CRLF; // change to static char ngx_http_server_string [] = "Server: Ninja Web Server" CRLF; static char ngx_http_server_full_string [] = "Server: Ninja Web Server" CRLF;

Disable nginx version display

server_tokens off

5. Limitations based on Iptables Firewall

The following firewall script blocks all except allow:

• Requests from HTTP (TCP port 80)

• Requests from ICMP ping

• Ntp (Port 123) Request output

• Smtp (TCP port 25) Request output

6. Control Buffer Overflow attacks

The size limit for editing and setting all client buffers is as follows:

client_body_buffer_size  1K;client_header_buffer_size 1k;client_max_body_size 1k;large_client_header_buffers 2 1k;

• Client_body_buffer_size 1 k (8 k or 16 k by default) This command can specify the buffer size of the Connection Request Entity. If the connection request exceeds the value specified in the cache, the whole or part of these request entities will try to write into a temporary file.

• The client_header_buffer_size 1 k-command specifies the buffer size of the client request header. In most cases, the next request header is not greater than 1 k. However, if a large cookie from the wap client is larger than 1 k, Nginx will allocate a larger buffer, this value can be set in large_client_header_buffers.

• The client_max_body_size 1 k-command specifies the maximum Request Entity size allowed for client connection. It appears in the Content-Length Field of the request header. If the Request is greater than the specified value, the client will receive a "Request Entity Too Large" (413) error. Remember, the browser does not know how to display this error.

• Large_client_header_buffers-specify the number and size of buffers used by some large request headers on the client. The Request field cannot exceed the buffer size. If the client sends a large header, nginx returns "Request URI too large" (414)

• Similarly, the maximum field in the request header cannot be greater than a buffer; otherwise, the server returns "Bad request" (400 ). The buffer zone is only available when required. By default, a buffer size is the size of paging files in the operating system, usually 4 k or 8 k. If a connection request finally converts the status to keep-alive, the buffer zone it occupies will be released.

You also need to control the timeout to improve server performance and disconnect from the client. Edit as follows:

client_body_timeout   10;client_header_timeout 10;keepalive_timeout     5 5;send_timeout          10;

• Client_body_timeout 10;-The command specifies the time-out time for reading the request object. The timeout here means that a Request entity does not enter the read step. If the connection exceeds this time and the client does not respond, Nginx returns a "Request time out" (408) error.
• Client_header_timeout 10;-The command specifies the timeout time for reading the client request header title. Timeout indicates that a Request header does not enter the read step. If the connection exceeds this time and the client does not respond, Nginx returns a "Request time out" (408) error.
• Keepalive_timeout 5;-the first value of the parameter specifies the timeout time for the long connection between the client and the server. After this time, the server closes the connection. The second value of the parameter (optional) specifies the time value of Keep-Alive: timeout = time in the Response Header. This value allows some browsers to know when to close the connection, so that the server does not need to be shut down repeatedly. If this parameter is not specified, nginx will not send the Keep-Alive information in the response header. (But this does not mean how to connect "Keep-Alive") the two values of the parameter can be different.
• Send_timeout 10; the command specifies the Timeout time after the response is sent to the client. Timeout indicates that the client has not entered the full established status and has only completed two handshakes. If no response is received by the client after this time, nginx will close the connection.

VII. Control concurrent connections

You can use the NginxHttpLimitZone module to limit the concurrent connections of a specified session or an IP address in special circumstances. Edit nginx. conf:

### Directive describes the zone, in which the session states are stored i.e. store in slimits. ###### 1m can handle 32000 sessions with 32 bytes/session, set to 5m x 32000 session ###limit_zone slimits $binary_remote_addr 5m;### Control maximum number of simultaneous connections for one session i.e. ###### restricts the amount of connections from a single ip address ###limit_conn slimits 5;

It indicates that each client with a remote IP address cannot open more than five connections at the same time.

8. Only access to our domain names is allowed

If the robot only randomly scans all domain names on the server, the request is rejected. You must allow the configured virtual domain or reverse proxy request. You do not need to use an IP address to reject the request.

if ($host !~ ^(test.in|www.test.in|images.test.in)$ ) {    return 444;}

9. restrict available request methods

GET and POST are the most common methods on the Internet. The Web server method is defined in RFC 2616. If the Web server does not require all available methods to be enabled, they should be disabled. The following command filters only GET, HEAD, and POST methods:

## Only allow these request methods ##if ($request_method !~ ^(GET|HEAD|POST)$ ) {    return 444;}## Do not accept DELETE, SEARCH and other methods ##