SCG WS nginx

NEEDS TO BE REVIEWED, SEE REFERENCES BELOW FOR A GOOD MATERIAL!

Summary
A detailed description of the product (can be taken from the official website)

Description
%ProductName% allows unauthorized attacker to list all users of the system ...

// Detailed description of the impact. Is it enabled by default? Vulnerable versions.

How to test
In order to test for %Misconfiguration_1%, one should ...

// Proof-of-concept here. Please include the screenshots and widely known tools/scanners!

Remediation
Initial/common value of parameter "listUsers" from config.xml is set to "true".

To assess the vulnerability it is enough to change the value to false:

false

Buffer Overflow Protection
client_body_buffer_size 1K; client_header_buffer_size 1k; client_max_body_size 1k; large_client_header_buffers 2 1k;
 * 1) Size Limits & Buffer Overflows ##
 * 2) the size below needs testing with subject to the real needs


 * 1) END ##

Refer to

Remove Unnecessary backup files
Use the following command to search if there is any unnecessary backup files to be removed.
 * 1) find /nginx -name '.?*' -not -name .ht* -or -name '*~' -or -name '*.bak*' -or -name '*.old*'
 * 2) find /usr/local/nginx/html/ -name '.?*' -not -name .ht* -or -name '*~' -or -name '*.bak*' -or -name '*.old*'

Mitigating Slow HTTP DoS Attack
client_body_timeout  10; client_header_timeout 10; keepalive_timeout    5 5; send_timeout         10; The “Keep-Alive: timeout=time” header field is recognized by Mozilla and Konqueror. MSIE closes keep-alive connections by itself in about 60 seconds.
 * 1) Timeouts definition ##
 * 1) End ##
 * client_body_timeout: Defines a timeout for reading client request body. The timeout is set only for a period between two successive read operations, not for the transmission of the whole request body. If a client does not transmit anything within this time, the 408 (Request Time-out) error is returned to the client.
 * client_header_timeout: Defines a timeout for reading client request header. If a client does not transmit the entire header within this time, the 408 (Request Time-out) error is returned to the client.
 * keepalive_timeout: The first parameter sets a timeout during which a keep-alive client connection will stay open on the server side. The zero value disables keep-alive client connections. The optional second parameter sets a value in the “Keep-Alive: timeout=time” response header field. Two parameters may differ.
 * send_timeout: Sets a timeout for transmitting a response to the client. The timeout is set only between two successive write operations, not for the transmission of the whole response. If the client does not receive anything within this time, the connection is closed.

Allow Access To Specified Domain Only
if ($host !~ ^(abc.com|www.abc.com|images.abc.com)$ ) { return 444; }
 * 1)  i.e. abc.com, images.abc.com and www.abc.com

Limit IP clients access
Limit specific folder to certain source IP clients only.

## the docs folder is only allowed specific IP range in 192.168.1.0/24

location /docs/ { ## block one workstation deny   192.168.1.1; ## allow anyone in 192.168.1.0/24 allow  192.168.1.0/24; ## drop rest of the world deny   all; }

TLS Configuration
Disable SSLv3(enabled by default since nginx 0.8.19) server { # SSL protocols TLS v1~TLSv1.2 are allowed. Disabed SSLv3 ssl_protocols TLSv1 TLSv1.1 TLSv1.2; }

Refer to

HTTP secure Header
add_header X-Frame-Options SAMEORIGIN;
 * 1) X-Frame-Options is to prevent from clickJacking attack

add_header X-Content-Type-Options nosniff;
 * 1)  disable content-type sniffing on some browsers.

add_header X-XSS-Protection "1; mode=block";
 * 1) This header enables the Cross-site scripting (XSS) filter

add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
 * 1) This will enforce HTTP browsing into HTTPS and avoid ssl stripping attack

refer to https://www.owasp.org/index.php/List_of_useful_HTTP_headers

Limit HTTP Method
if ($request_method !~ ^(GET|PUT|POST)$ ) { return 444; }
 * 1) Only GET, Post, PUT are allowed##
 * 1) Do not accept HEAD, DELETE, SEARCH and other methods ##