SCG WS nginx - Revision history

Tony Hsu HsiangChih: /* SSL Module */

2017-01-14T07:08:45Z

‎SSL Module

Tony Hsu HsiangChih: /* SSL Module */

2017-01-14T07:08:05Z

‎SSL Module

Tony Hsu HsiangChih: /* Mitigating Slow HTTP DoS Attack */

2016-04-22T00:50:36Z

‎Mitigating Slow HTTP DoS Attack

Tony Hsu HsiangChih: /* Mitigating Slow HTTP DoS Attack */

2016-04-22T00:50:03Z

‎Mitigating Slow HTTP DoS Attack

Tony Hsu HsiangChih: /* Buffer Overflow Protection */

2016-04-22T00:49:45Z

‎Buffer Overflow Protection

Tony Hsu HsiangChih: /* Limit HTTP Method */

2016-04-22T00:26:06Z

‎Limit HTTP Method

Tony Hsu HsiangChih: /* Buffer Overflow Protection */

2016-04-21T14:54:18Z

‎Buffer Overflow Protection

Tony Hsu HsiangChih: /* Summary */

2016-04-21T14:43:00Z

‎Summary

Tony Hsu HsiangChih: /* Remove Unnecessary backup files */

2016-04-21T14:42:33Z

‎Remove Unnecessary backup files

Tony Hsu HsiangChih: /* Mitigating Slow HTTP DoS Attack */

2016-04-21T14:42:23Z

‎Mitigating Slow HTTP DoS Attack

@@ Line 118: / Line 118: @@
 	# -!LOW：   exclude encryption cipher suites using 64 or 56 bit encryption algorithms
 	# -!EXPORT： exclude export encryption algorithms including 40 and 56 bits algorithms.
-	# -!aNULL：  exclude the cipher suites offering no authentication. This is currently the anonymous DH algorithms and anonymous ECDH algorithms. These cipher suites are vulnerable to a "man in the middle" attack and so their use is normally discouraged.
+	# -!aNULL：  exclude the cipher suites offering no authentication. This is currently the anonymous DH algorithms and anonymous ECDH algorithms.
-	# -!eNULL：exclude the "NULL" ciphers that is those offering no encryption. Because these offer no encryption at all and are a security risk they are disabled unless explicitly included.
+        # These cipher suites are vulnerable to a "man in the middle" attack and so their use is normally discouraged.
 	# @STRENGTH：sort the current cipher list in order of encryption algorithm key length.

@@ Line 113: / Line 113: @@
       # Disabled insecure ciphers suite. For example, MD5, DES, RC4, PSK
-       ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
+       ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4:@STRENGTH";
+}
 </pre>
 === HTTP secure Header ===

@@ Line 63: / Line 63: @@
 * client_body_timeout: Defines a timeout for reading client request body. The timeout is set only for a period between two successive read operations, not for the transmission of the whole request body. If a client does not transmit anything within this time, the 408 (Request Time-out) error is returned to the client.
 * client_header_timeout: Defines a timeout for reading client request header. If a client does not transmit the entire header within this time, the 408 (Request Time-out) error is returned to the client.
-* keepalive_timeout: The first parameter sets a timeout during which a keep-alive client connection will stay open on the server side. The zero value disables keep-alive client connections. The optional second parameter sets a value in the “Keep-Alive: timeout=time” response header field. Two parameters may differ.
+* keepalive_timeout: The first parameter sets a timeout during which a keep-alive client connection will stay open on the server side. The zero value disables keep-alive client connections. The optional second parameter sets a value in the “Keep-Alive: timeout=time” response header field. Two parameters may differ. The “Keep-Alive: timeout=time” header field is recognized by Mozilla and Konqueror. MSIE closes keep-alive connections by itself in about 60 seconds.
 * send_timeout: Sets a timeout for transmitting a response to the client. The timeout is set only between two successive write operations, not for the transmission of the whole response. If the client does not receive anything within this time, the connection is closed.

@@ Line 68: / Line 68: @@
 Refer here for detailed of each configuration value.
- http://nginx.org/en/docs/http/ngx_http_core_module.html
+http://nginx.org/en/docs/http/ngx_http_core_module.html
 === Allow Access To Specified Domain Only ===

@@ Line 24: / Line 24: @@
   ## Size Limits & Buffer Overflows
   ## the size may be configured based on the needs.
-   client_body_buffer_size  1K;
+   client_body_buffer_size  100K;
    client_header_buffer_size 1k;
-   client_max_body_size 1k;
+   client_max_body_size 100k;
    large_client_header_buffers 2 1k;
@@ Line 33: / Line 33: @@
 Refer here for detailed of each configuration value.
 http://nginx.org/en/docs/http/ngx_http_core_module.html
 === Remove Unnecessary backup files ===

@@ Line 142: / Line 142: @@
           return 444;
+      }
-## Do not accept HEAD, DELETE, SEARCH and other methods ##
+## In this case, it does not accept other HTTP method such as HEAD, DELETE, SEARCH, TRACE ##
 </pre>
 == References ==

@@ Line 7: / Line 7: @@
 It includes the following topic:
-* Buffer Overflow Protection
+.1 Buffer Overflow Protection
-* Remove Unnecessary backup files
+.2 Remove Unnecessary backup files
-* Mitigating Slow HTTP DoS Attack
+.3 Remove Version number
-* Allow Access To Specified Domain Only
+.4 Mitigating Slow HTTP DoS Attack
-* Limit IP clients access
+.5 Allow Access To Specified Domain Only
-* SSL/TLS Configuration
+.6 Limit IP clients access
-* HTTP secure Header
+.7 SSL/TLS Configuration
-* Limit HTTP Method
+.8 SSL Module
-* SSL Module
+.9 HTTP secure Header
 == Secure Configuration  ==

@@ Line 41: / Line 41: @@
 </pre>
-=== Remove Version number
+=== Remove Version number ===
 <pre>
 # Display nginx Version number in error or http header may result in hacker to search for known vulnerability.