Security Tips for Nginx

Understanding Nginx Security Basics

Before delving into specific hardening techniques, it’s crucial to grasp the foundation of Nginx security. While Nginx comes with several built-in security features, knowing how to leverage them effectively is essential.

Default Nginx Security Features

Nginx includes several security-enhancing features by default:

• Request limiting and connection throttling
• Basic access authentication
• IP-based access control
• SSL/TLS support for encrypted connections

Although these features provide a solid starting point, they often require additional configuration to maximize their effectiveness.

Common Security Vulnerabilities

Despite its robust architecture, Nginx can be vulnerable to various security issues if not properly configured. Some common problems include:

• Information disclosure through server tokens
• Weak SSL/TLS configurations
• Improper access controls
• Misconfigured file permissions
• Outdated software versions

The Importance of Regular Updates

Maintaining a secure web server requires keeping Nginx and its dependencies up to date. Regular updates patch known vulnerabilities and introduce new security features. It’s crucial to monitor official Nginx security advisories and promptly apply updates.

Securing Nginx Installation

A secure Nginx server starts with a proper installation. Follow these best practices to establish a solid security foundation:

Choosing a Secure Installation Method

When installing Nginx, use official package repositories or compile from source using verified tarballs. Steer clear of third-party repositories or pre-compiled binaries from untrusted sources.

Verifying Package Integrity

Always check the integrity of downloaded Nginx packages or source code. Utilize GPG signatures or checksums from the official Nginx website to ensure you’re installing authentic, unaltered software.

Removing Unnecessary Modules

Nginx’s modular design allows for customization. When compiling from source, include only essential modules. Eliminating unnecessary ones shrinks the attack surface and reduces potential vulnerabilities. For instance, if you don’t need WebDAV support, skip compiling Nginx with the ngx_http_dav_module.

Configuring Nginx for Enhanced Security

Proper configuration is crucial for hardening Nginx. Let’s explore several critical settings that can significantly improve your server’s security:

Disabling Server Tokens

Server tokens reveal information about your Nginx version, which attackers can use to identify potential vulnerabilities. Disable server tokens by adding this directive to your nginx.conf file:

server_tokens off;

Implementing Strong SSL/TLS Settings

Secure communication is essential for protecting sensitive data. Configure Nginx to use strong SSL/TLS settings:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;

Configuring HTTP Headers for Security

Add security-related HTTP headers to protect against various attacks:

add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;

Limiting Request Size and Timeouts

Prevent potential denial-of-service attacks by limiting request sizes and setting appropriate timeouts:

client_max_body_size 10M;
client_body_timeout 12;
client_header_timeout 12;
keepalive_timeout 15;
send_timeout 10;

Implementing Access Controls

Use Nginx’s built-in access control directives to restrict access to sensitive areas of your website:

location /admin {
    allow 192.168.1.0/24;
    deny all;}

Implementing Web Application Firewall (WAF)

A Web Application Firewall (WAF) enhances security by scrutinizing incoming traffic and blocking malicious requests.

Introduction to ModSecurity

ModSecurity, a widely-used open-source WAF, integrates seamlessly with Nginx. It offers real-time application security monitoring, logging, and access control.

Installing and Configuring ModSecurity with Nginx

To set up ModSecurity with Nginx, follow these steps:

1. Install the required dependencies
2. Download and compile ModSecurity
3. Compile Nginx with the ModSecurity module
4. Set up ModSecurity rules

Here’s a simple ModSecurity configuration for Nginx:

load_module modules/ngx_http_modsecurity_module.so;

http {
    modsecurity on;
    modsecurity_rules_file /etc/nginx/modsecurity/main.conf;}

Writing Custom WAF Rules

ModSecurity comes with a core rule set, but you can craft custom rules to address specific security concerns for your application. For instance, you might want to block requests containing a particular user agent:

SecRule REQUEST_HEADERS:User-Agent"malicious-bot""id:1000,deny,status:403,msg:'Malicious bot detected'"

Securing File Permissions and Ownership

Proper file permissions and ownership are vital for maintaining a secure Nginx installation. By carefully managing who can access and modify files, you significantly reduce the risk of unauthorized changes and potential security breaches.

Setting Proper File Permissions

Ensure that Nginx configuration files and web content have appropriate permissions to prevent unauthorized access or modifications:

chmod 644/etc/nginx/nginx.conf
chmod 644/etc/nginx/conf.d/*.conf
chmod 755 /var/www/html

Setting Correct Ownership

Assign proper ownership for Nginx files and directories:

chown -R root:root /etc/nginx
chown -R www-data:www-data /var/www/html

Implementing the Principle of Least Privilege

To enhance security, run Nginx as a non-root user with minimal necessary permissions. Create a dedicated user and group specifically for Nginx:

groupadd -r nginx
useradd -r -g nginx -s /sbin/nologin -M nginx

Then, configure Nginx to run as this user in your nginx.conf:

user nginx nginx;

Monitoring and Logging

Effective monitoring and logging are crucial for detecting and responding to security incidents promptly. By implementing robust logging practices, you can gain valuable insights into your server’s activities and potential threats.

Configuring Nginx Logging

To enhance your server’s security posture, enable detailed logging in Nginx by configuring both access and error logs:

http {
    log_format detailed '$remote_addr - $remote_user [$time_local] ''"$request" $status $body_bytes_sent ''"$http_referer" "$http_user_agent" "$http_x_forwarded_for"';
    access_log /var/log/nginx/access.log detailed;
    error_log /var/log/nginx/error.log;}

Implementing Log Rotation

Utilize logrotate to efficiently manage Nginx log files, preventing them from consuming excessive disk space:

/var/log/nginx/*.log {
    daily
    missingok
    rotate 52
    compress
    delaycompress
    notifempty
    create 0640 nginx adm
    sharedscripts
    postrotate
        if [ -f /var/run/nginx.pid ]; then
            kill -USR1 `cat /var/run/nginx.pid`
        fi
    endscript
}

Using Log Analysis Tools

Implement log analysis tools such as GoAccess or ELK Stack (Elasticsearch, Logstash, Kibana) to gain valuable insights from your Nginx logs and detect potential security issues.

Setting up Alerts for Suspicious Activities

Configure alerts for suspicious activities using tools like Fail2Ban or custom scripts. These tools monitor your Nginx logs and notify you of potential security threats, enabling prompt response to incidents.

Protecting Against Common Attacks

Nginx can be configured to mitigate various common web attacks. Here are some key strategies:

Mitigating DDoS Attacks

Implement rate limiting as a crucial defense against DDoS attacks. This approach helps control the flow of incoming requests:

http {
    limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;
    server {
        location /{
            limit_req zone=one burst=5;}}}

Preventing SQL Injection

Although SQL injection is primarily an application-level concern, Nginx can help mitigate these attacks by blocking requests that contain suspicious SQL patterns:

location /{if($query_string ~"union.*select.*\("){return403;}if($query_string ~"concat.*\("){return403;}}

Defending Against Cross-Site Scripting (XSS)

Enable XSS protection headers and implement a Content Security Policy to enhance security:

add_header X-XSS-Protection"1; mode=block" always;
add_header Content-Security-Policy"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval';" always;

Preventing Clickjacking Attacks

Protect against clickjacking by setting the X-Frame-Options header:

add_header X-Frame-Options"SAMEORIGIN" always;

Regular Security Audits and Updates

Maintaining a secure Nginx server demands continuous effort and vigilance.

Importance of Regular Security Audits

Perform frequent security audits of your Nginx configuration to uncover potential vulnerabilities and ensure adherence to best practices. Employ both automated tools and manual reviews for a comprehensive assessment of your server’s security posture.

Tools for Nginx Security Scanning

Leverage security scanning tools tailored for Nginx, including:

• Nikto
• OWASP ZAP
• Nmap with NSE scripts
• Lynis

Keeping Nginx and Dependencies Up to Date

Consistently update Nginx and its dependencies to ensure you have the latest security patches. Subscribe to security mailing lists and monitor official Nginx announcements to stay informed about new vulnerabilities and updates.

Additional Security Measures

Enhance your Nginx server’s protection with these supplementary security measures:

Implementing Content Security Policy (CSP)

Content Security Policy safeguards against various attacks, including XSS and data injection. Implement CSP headers in Nginx:

add_header Content-Security-Policy"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:;" always;

Using HTTP Strict Transport Security (HSTS)

HSTS ensures browsers consistently connect to your site over HTTPS, thwarting downgrade attacks. Enable HSTS in Nginx:

add_header Strict-Transport-Security"max-age=31536000; includeSubDomains" always;

Configuring Rate Limiting

Implement rate limiting to defend against brute force attacks and excessive requests:

http {
    limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s;
    server {
        location /{
            limit_req zone=mylimit burst=20 nodelay;}}}

Reference

• https://nginx.org/
• https://idroot.us/nginx-hardening-security/

Feedback

Name

Email

Send