Tag: nginx

Posted on

nginx prevent process undefined server names

Use default_server to prevent processing requests with undefined server names

http {
...

  server {
    listen 80 default_server;
    listen [::]:80 default_server;
    # close connection
    return 444;
  }
}

If use http to https redirect

http {
...
  server {
    listen 80;
    listen [::]:80;
    name_server _;

    location ^~ /.well-known/acme-challenge {
      # Install https://certbot.eff.org/
      # letsencrypt/certbot certonly --webroot --email [email protected] --agree-tos --sta$
      default_type text/plain;
      root /etc/letsencrypt/webroot;
      try_files $uri $uri/ =404;
    }

    location / {
      # redirect all requests to https
      return 301 https://$host$request_uri;
    }
  }

  server {
    listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server;
    name_server _;
    # Enable SSL
    ssl on;
    ssl_certificate /etc/ssl/private/local.crt;
    ssl_certificate_key /etc/ssl/private/local.key;
    # close connection
    return 444;
  }
}

 

Posted on

HPKP with letsencrypt and nginx

Get SPKI-hash

Let’s Encrypt Authority X4

curl https://letsencrypt.org/certs/lets-encrypt-x4-cross-signed.pem | openssl x509 -pubkey | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | base64

Let’s Encrypt Authority X3

curl https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem | openssl x509 -pubkey | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | base64

ISRG Root X1

curl https://letsencrypt.org/certs/isrgrootx1.pem | openssl x509 -pubkey | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | base64

Add config to nginx

add_header Public-Key-Pins 'pin-sha256="X4-Hash"; pin-sha256="X3-Hash"; pin-sha256="X1-Hash"; max-age=15768000;';

Reload nginx

nginx -s reload

 

Posted on

nginx config

/etc/nginx/nginx.conf


# Server globals
user nginx;
# Set number of worker processes automatically based on number of CPU cores.
worker_processes auto;
worker_cpu_affinity auto;
worker_rlimit_nofile 65535;
# Configures default error logger.
#error_log /var/log/nginx/error.log crit;
error_log /var/log/nginx/error.log;
pid /var/run/nginx.pid;
# Includes files with directives to load dynamic modules.
#load_module modules/ngx_http_modsecurity_module.so;
# Worker config
events {
# determines how much clients will be served per worker
# max clients = worker_connections * worker_processes
# max clients is also limited by the number of socket connections available on the system (~64k)
worker_connections 4096;
# optmized to serve many clients with each thread, essential for linux
use epoll;
# accept as many connections as possible, may flood worker connections if set too low
multi_accept on;
}
http {
# Main settings
limit_req_zone $binary_remote_addr zone=req_limit_per_ip:10m rate=30r/m;
limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m;
# Enable of asynchronous file I/O works on linux
aio threads;
aio_write on;
# copies data between one FD and other from within the kernel
# faster then read() + write()
sendfile on;
# send headers in one peace, its better then sending them one by one
tcp_nopush on;
# don't buffer data sent, good for small data bursts in real time
tcp_nodelay on;
# allow the server to close connection on non responding client, this will free up memory
reset_timedout_connection on;
# Nginx Simple DDoS Defense
client_header_timeout 1m;
client_body_timeout 1m;
client_header_buffer_size 2k;
client_body_buffer_size 256k;
client_max_body_size 16m;
large_client_header_buffers 4 8k;
# Just For Security Reason
server_tokens off;
server_name_in_redirect off;
server_names_hash_max_size 512;
server_names_hash_bucket_size 512;
# Log format
log_format main '$remote_addr – $remote_user [$time_local] $request '
'"$status" $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
log_format bytes '$body_bytes_sent';
# to boost I/O on HDD we can disable access logs
#access_log /var/log/nginx/access.log main;
access_log off;
# Mime settings
include /etc/nginx/mime.types;
default_type application/octet-stream;
# Proxy settings
proxy_http_version 1.1;
proxy_cache_bypass $http_upgrade;
# Proxy headers
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port $server_port;
# Proxy timeouts
proxy_connect_timeout 60s;
proxy_send_timeout 90s;
proxy_read_timeout 90s;
# Restore Real IP Cloudflare https://www.cloudflare.com/ips
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 104.16.0.0/12;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 131.0.72.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
set_real_ip_from 2400:cb00::/32;
set_real_ip_from 2606:4700::/32;
set_real_ip_from 2803:f800::/32;
set_real_ip_from 2405:b500::/32;
set_real_ip_from 2405:8100::/32;
set_real_ip_from 2c0f:f248::/32;
set_real_ip_from 2a06:98c0::/29;
# Use real IPs
real_ip_header CF-Connecting-IP;
#real_ip_header X-Forwarded-For;
# OCSP Stapling
ssl_stapling on;
ssl_stapling_verify on;
resolver 1.1.1.2 8.8.8.8 208.67.222.222 valid=60s;
resolver_timeout 2s;
# SSL PCI Compliance
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ecdh_curve X25519:prime256v1:secp384r1;
# Server Side TLS
# SSL/TLS Configuration Generator
# https://mozilla.github.io/server-side-tls/ssl-config-generator/
# Oldest compatible clients
# Firefox 1, Chrome 1, IE 8 on Windows 7, Opera 5, Safari 1, Android 2.3, Java 7
ssl_ciphers "ECDHE+CHACHA20:ECDHE+AESGCM:DHE+AESGCM:ECDHE+AES:DHE+AES:RSA+AESGCM:RSA+AES:!DES-CBC3-SHA:!DSS";
# DH parameter for Perfect Forward Secrecy
# openssl dhparam -dsaparam -out /etc/ssl/dhparam.pem 4096
ssl_dhparam /etc/ssl/dhparam.pem;
# Various security headers
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options "nosniff";
add_header Referrer-Policy "no-referrer-when-downgrade";
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'";
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
# Error pages
error_page 403 /var/www/error/403.html;
error_page 404 /var/www/error/404.html;
error_page 502 503 504 /var/www/error/500.html;
# Cache
proxy_cache_path /var/cache/nginx levels=2 keys_zone=cache:10m inactive=60m max_size=512m;
proxy_cache_key md5("$host$request_uri$cookie_user");
proxy_temp_path /var/cache/nginx/temp;
proxy_ignore_headers X-Accel-Expires Expires Cache-Control;
proxy_cache_use_stale error timeout invalid_header updating http_502;
proxy_cache_valid any 24h;
proxy_cache_bypass $http_upgrade;
# Cache bypass
map $http_cookie $no_cache {
default 0;
~SESS 1;
~wordpress_logged_in 1;
}
# File cache settings
open_file_cache max=10000 inactive=30s;
open_file_cache_valid 60s;
open_file_cache_min_uses 2;
open_file_cache_errors off;
# ModSecurity
#modsecurity on;
#modsecurity_rules_file /etc/nginx/modsec/main.conf;
# Wildcard include
include /etc/nginx/conf.d/http/*.conf;
}
stream {
resolver 1.1.1.2 8.8.8.8 208.67.222.222 valid=60s;
resolver_timeout 2s;
# Wildcard include
include /etc/nginx/conf.d/stream/*.conf;
}

view raw

nginx.conf

hosted with ❤ by GitHub

/etc/nginx/conf.d/http/letsencrypt.conf

https://gist.github.com/bouroo/fb391e2de7fa05a0d528031b97728cef#file-letsencrypt-conf

/etc/nginx/conf.d/http/web.conf

https://gist.github.com/bouroo/fb391e2de7fa05a0d528031b97728cef#file-web-conf

/etc/nginx/conf.d/stream/mariadb.conf

https://gist.github.com/bouroo/fb391e2de7fa05a0d528031b97728cef#file-mariadb-conf