Nginx saugumo taisyklės

Keletas taisyklių saugumui bei spartai pakelti. Taisyklės naudojamos nginx.conf.

# don't send the nginx version number in error pages and Server header
server_tokens off;
# config to don't allow the browser to render the page inside an frame or iframe
# and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
# if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
# https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
add_header X-Frame-Options SAMEORIGIN;
# when serving user-supplied content, include a X-Content-Type-Options: nosniff header along with the Content-Type: header, 
# to disable content-type sniffing on some browsers.
# https://www.owasp.org/index.php/List_of_useful_HTTP_headers
# currently suppoorted in IE > 8 http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx
# http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx 
# 'soon' on Firefox https://bugzilla.mozilla.org/show_bug.cgi?id=471020
add_header X-Content-Type-Options nosniff;
# This header enables the Cross-site scripting (XSS) filter built into most recent web browsers.
# It's usually enabled by default anyway, so the role of this header is to re-enable the filter for 
# this particular website if it was disabled by the user.
# https://www.owasp.org/index.php/List_of_useful_HTTP_headers
add_header X-XSS-Protection "1; mode=block";
# with Content Security Policy (CSP) enabled(and a browser that supports it(http://caniuse.com/#feat=contentsecuritypolicy),
# you can tell the browser that it can only download content from the domains you explicitly allow
# http://www.html5rocks.com/en/tutorials/security/content-security-policy/
# https://www.owasp.org/index.php/Content_Security_Policy
# I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval'
# directives for css and js(if you have inline css or js, you will need to keep it too).
# more: http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src  'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src  'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";
# Common bandwidth hoggers and hacking tools.
map $http_user_agent $limit_bots {
   default 0;
   ~*(AltaVista|Slurp|BlackWidow|Bot|ChinaClaw|Custo|DISCo|Download|Demon|eCatch|EirGrabber|EmailSiphon|EmailWolf|SuperHTTP|Surfbot|WebWhacker) 1;
   ~*(Express|WebPictures|ExtractorPro|EyeNetIE|FlashGet|GetRight|GetWeb!|Go!Zilla|Go-Ahead-Got-It|GrabNet|Grafula|HMView|Go!Zilla|Go-Ahead-Got-It) 1;
    ~*(rafula|HMView|HTTrack|Stripper|Sucker|Indy|InterGET|Ninja|JetCar|Spider|larbin|LeechFTP|Downloader|tool|Navroad|NearSite|NetAnts|tAkeOut|WWWOFFLE) 1;
   ~*(GrabNet|NetSpider|Vampire|NetZIP|Octopus|Offline|PageGrabber|Foto|pavuk|pcBrowser|RealDownload|ReGet|SiteSnagger|SmartDownload|SuperBot|WebSpider) 1;
   ~*(Teleport|VoidEYE|Collector|WebAuto|WebCopier|WebFetch|WebGo|WebLeacher|WebReaper|WebSauger|eXtractor|Quester|WebStripper|WebZIP|Wget|Widow|Zeus) 1;
   ~*(Twengabot|htmlparser|libwww|Python|perl|urllib|scan|Curl|email|PycURL|Pyth|PyQ|WebCollector|WebCopy|webcraw) 1;
}
# Expires map
map $sent_http_content_type $expires {
   default                    off;
   text/html                  epoch;
   text/css                   max;
   application/javascript     max;
   ~image/                    max;
}

Taisyklės naudojamos server {} bloke.

SSL

ssl_session_cache shared:SSL:50m;
ssl_session_timeout 5m;
 # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
 ssl_dhparam /etc/nginx/ssl/dhparam.pem;
 # enables server-side protection from BEAST attacks
 # http://blog.ivanristic.com/2013/09/is-beast-still-a-threat.html
 ssl_prefer_server_ciphers on;
 # disable SSLv3(enabled by default since nginx 0.8.19) since it's less secure then TLS http://en.wikipedia.org/wiki/Secure_Sockets_Layer#SSL_3.0
 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 # ciphers chosen for forward secrecy and compatibility
 # http://blog.ivanristic.com/2013/08/configuring-apache-nginx-and-openssl-for-forward-secrecy.html
 ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
 # enable ocsp stapling (mechanism by which a site can convey certificate revocation information to visitors in a privacy-preserving, scalable manner)
 # http://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/
 resolver 8.8.8.8;
 ssl_stapling on;
 ssl_trusted_certificate /etc/nginx/ssl/star_forgott_com.crt;
 # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
 # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
 add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";

Performance

expires $expires;
        # This block will catch static file requests, such as images, css, js
       # The ?: prefix is a 'non-capturing' mark, meaning we do not require
       # the pattern to be captured into $1 which should help improve performance
       location  ~ ^/pictures/product/(?:ico|css|js|gif|jpg|jpeg|png|woff|ttf|otf|svg|woff2|eot)$ {
           add_header Cache-Control "public, no-transform";
           etag on;
       }
       # CSS and Javascript
       location ~* \.(?:css|js)$ {
         expires 1y;
         access_log off;
         add_header Cache-Control "public";
       }

Security

            #BLOCK FROM MAP
           if ($limit_bots = 1) {
             return 403;
           }
           ##
           ## Deny certain Referers ###
           if ( $http_referer ~* (babes|forsale|girl|jewelry|love|nudit|organic|poker|porn|sex|teen) )
           {
                return 403;
           }
           ##
           ## Block SQL injections 
           set $block_sql_injections 0;
           if ($query_string ~ "union.*select.*\(") {
               set $block_sql_injections 1;
           }
           if ($query_string ~ "union.*all.*select.*") {
               set $block_sql_injections 1;
           }
           if ($query_string ~ "concat.*\(") {
               set $block_sql_injections 1;
           }
           if ($block_sql_injections = 1) {
               return 403;
           }
           ## Block file injections
           set $block_file_injections 0;
           if ($query_string ~ "[a-zA-Z0-9_]=http://") {
               set $block_file_injections 1;
           }
           if ($query_string ~ "[a-zA-Z0-9_]=(\.\.//?)+") {
               set $block_file_injections 1;
           }
           if ($query_string ~ "[a-zA-Z0-9_]=/([a-z0-9_.]//?)+") {
               set $block_file_injections 1;
           }
           if ($block_file_injections = 1) {
               return 403;
           }
           ## Block common exploits
           set $block_common_exploits 0;
           if ($query_string ~ "(<|%3C).*script.*(>|%3E)") {
               set $block_common_exploits 1;
           }
           if ($query_string ~ "GLOBALS(=|\[|\%[0-9A-Z]{0,2})") {
               set $block_common_exploits 1;
           }
           if ($query_string ~ "_REQUEST(=|\[|\%[0-9A-Z]{0,2})") {
               set $block_common_exploits 1;
           }
           if ($query_string ~ "proc/self/environ") {
               set $block_common_exploits 1;
           }
           if ($query_string ~ "mosConfig_[a-zA-Z_]{1,21}(=|\%3D)") {
               set $block_common_exploits 1;
           }
           if ($query_string ~ "base64_(en|de)code\(.*\)") {
               set $block_common_exploits 1;
           }
           if ($block_common_exploits = 1) {
               return 403;
           }
           ## Block spam
           set $block_spam 0;
           if ($query_string ~ "\b(ultram|unicauca|valium|viagra|vicodin|xanax|ypxaieo)\b") {
               set $block_spam 1;
           }
           if ($query_string ~ "\b(erections|hoodia|huronriveracres|impotence|levitra|libido)\b") {
               set $block_spam 1;
           }
           if ($query_string ~ "\b(ambien|blue\spill|cialis|cocaine|ejaculation|erectile)\b") {
               set $block_spam 1;
           }
           if ($query_string ~ "\b(lipitor|phentermin|pro[sz]ac|sandyauer|tramadol|troyhamby)\b") {
               set $block_spam 1;
           }
           if ($block_spam = 1) {
               return 403;
           }
           # Protect specific TXT and config files
           location ~ /(\.|wp-config.php|readme.html|license.txt|schema.txt|password.txt|passwords.txt) 
           { 
                   deny all; 
           }
           # Protect ~ files
           location ~ ~$ 
           { 
                   access_log off; 
                   log_not_found off; 
                   deny all; 
           }
           # Protect .git files
           location ~ /\.git 
           { 
                   access_log off; 
                   log_not_found off; 
                   deny all; 
           }
           # Protect Perl/CGI/etc files
           location ~* \.(pl|cgi|py|sh|lua)\$ 
           {
                   return 444;
           }
           # Block web attacks
           location ~* (roundcube|webdav|smtp|http\:|soap|w00tw00t) 
           {
                   return 444;
           }
           # Protect other sensitive files
           location ~* \.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)$|^(\..*|Entries.*|Repository|Root|Tag|Template)$|\.php_
           {
                   return 444;
           }
           # Block execution of PHP files in uploads folders
           location ~* /(?:uploads|files)/.*\.php$ 
           {
                   deny all;
           }

http į https redirectas

server {
 listen 80;
 server_name .forgott.com;
 return 301 https://$host$request_uri;
}