Monday 22 February 2016

Secure nginx (1.10+) server configuration with reverse proxy

Below is an nginx (version 1.10+) configuration that I like to use as a baseline. It has been adapted from several sources (all mentioned below.)

server {
  # We bind to a specific interface - NOT
  listen X.X.X.X:443 ssl;

  ssl_certificate /etc/nginx/ssl/yourwebsite_cert.pem;
  # Ensure that your key has the correct its set e.g. chmod 600.
  ssl_certificate_key /etc/nginx/ssl/yourwebsite_key.key;

  # certs sent to the client in SERVER HELLO are concatenated in ssl_certificate
  ssl_session_timeout 1d;
  ssl_session_cache shared:SSL:50m;
  ssl_session_tickets off;

  # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
  ssl_dhparam /etc/nginx/ssl/dhparam.pem;

  # enables server-side protection from BEAST attacks
  ssl_prefer_server_ciphers on;
  # disable SSLv3 - we only want TLSv1/1.1/1.2 (ideally just 1.2 if we can get away with it.)
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  # ciphers chosen for forward secrecy and compatibility:

  # enable ocsp stapling (mechanism by which a site can convey certificate revocation information to visitors in a privacy-preserving, scalable manner)
  ssl_stapling on;
  ssl_stapling_verify on;

  # verify chain of trust of OCSP response using Root CA and Intermediate certs
  ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;

  # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
  add_header Strict-Transport-Security max-age=15768000;

  # Prevent clickjacking:
  add_header X-Frame-Options "SAMEORIGIN";

  # Disable sniffing in browsers:
  add_header X-Content-Type-Options nosniff;

  # X-XSS Protection header:
  add_header X-XSS-Protection "1; mode=block";

  # Define DNS resolver   resolver

  access_log  /var/log/nginx/yourdomain.log  combined;
  error_log  /var/log/nginx/yourdomain.error.log;

  # Reverse proxy configuration
     location / {
     proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
     proxy_redirect off;
     proxy_buffering off;
     proxy_set_header        Host            $host;
     proxy_set_header        X-Real-IP       $remote_addr;
     proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
     client_max_body_size 10M;
     deny       all;


# redirect all http traffic to https
server {
  listen 80;
  return 301 https://$host$request_uri;

Sources: (nginx 1.10.1 | intermediate profile | OpenSSL 1.0.1e)


Post a Comment