Nginx Tips and Tricks and Security Configuration

Here are some basic configuration I used in my lab:
1. Configure Nginx to do load balancer
2. Configure a backup server
3. Hide Nginx Version Information from Hacker
4. Verify Nginx.conf configuration before apply
5. Reload Nginx.conf without restart service
6. Domain Rewrite
7. Disable Obsolete SSL/TLS Protocols
8. Enable HTTPS
9. Add black and white list
10. Limit request method
11. Deny User-Agent
12. Picture anti-theft chain
13. Controlling the number of concurrent connections
14. Buffer overflow attack
15. Header settings
16. Reverse Proxy Basic Configuration

1. Configure Nginx to do load balancer

If you have multiple sites, you can configure Nginx to load balance between multiple servers.
There are two files you will need to change:

root@f0e9bd28fe02:/# cat /etc/nginx/nginx.conf
user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {  upstream mysec {
ip_hash;
    server 3.81.70.239:30000 weight=3;
    server 34.73.78.142:80 weight=2;
  }

    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    include /etc/nginx/conf.d/*.conf;
}
root@f0e9bd28fe02:/#

root@f0e9bd28fe02:/# cat /etc/nginx/conf.d/wordpress.conf
server {
    listen       80;
    server_name  www.51sec.org;

location / {
    proxy_pass       http://mysec;
    proxy_redirect             off;
    proxy_http_version         1.1;
    proxy_set_header Upgrade   $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host      $host;
    proxy_set_header X-Real-IP $remote_addr;
}
}
root@f0e9bd28fe02:/#

http {
  upstream project1 {
    server 127.0.0.1:8000 weight=3;
    server 127.0.0.1:8001 weitht=2;
    server 127.0.0.1:8002;
  }

  server {
    listen 80;
    server_name www.51sec.org;
    location / {
      proxy_pass http://project1;
    }
  }
}

sudo rm /etc/nginx/sites-enabled/default

sudo mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf.disabled

sudo systemctl restart nginx

sudo /etc/init.d/nginx restart

sudo /etc/init.d/nginx reload

root@f0e9bd28fe02:/# cat /etc/nginx/nginx.conf
.....

http {  upstream mysec {
##ip_hash;
##  server 3.81.70.239:30000 weight=3;
    server 34.73.78.142:80 weight=2;
    server 3.81.70.239:30000 backup  }

.....

3. Hide Nginx Version Information from Hacker
There are often security vulnerabilities for a certain version of nginx. Hiding the nginx version number has become one of the main security optimization methods. Of course, the most important thing is to upgrade and repair the vulnerability in a timely manner. Before the change:

vi /etc/nginx/nginx.conf

http {
server_tokens off;
}

After enabled server_token off :

4. Valid Nginx.conf configuration before apply
nginx -t

5. Reload Nginx.conf without restart service
nginx -s reload

/etc/init.d/nginx reload

6. Domain Rewrite

Method 1:

Method 2:

7. Disable Obsolete SSL/TLS Protocols

ssl_protocols TLSv1.1 TLSv1.2;

8. Enable HTTPS

9. Add black and white list


Whitelist configuration:


location / admin / {
allow 192.168.1.0/24;
deny all;
}
The above indicates that only hosts on the 192.168.1.0/24 network segment are allowed to access, and all others are denied


It can also be written as a blacklist to prohibit some addresses and allow all others, such as


location / ops-coffee / {
deny 192.168.1.0/24;
allow all;
}
More often, client requests go through layers of proxies. We need to limit them through $ http_x_forwarded_for, which can be written like this


set $ allow false;
if ($ http_x_forwarded_for = “211.144.204.2”) {set $ allow true;}
if ($ http_x_forwarded_for ~ “108.2.66. [89]”) {set $ allow true;}
if ($ allow = false) {return 404;}
Add account authentication


server {
location / {
auth_basic “please input user & passwd”;
auth_basic_user_file key / auth.key;
}
}

10. Limit request method


if ($ request_method! ~ ^ (GET | POST) $) {
return 405;
}
$ request_method can get the method of requesting nginx


The configuration allows only GETPOST method access, other methods return 405

#在配置文件里添加
location / {
     proxy_pass http://127.0.0.1:5000;
     proxy_redirect off;
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }