Ensure only modern TLS protocols are used

HochStufe 1Automatisiertnginx

Beschreibung

Only modern TLS protocols should be enabled in NGINX for all client connections and upstream connections. Removing legacy TLS and SSL protocols (SSL 3.0, TLS 1.0, 1.1 and 1.2), and enable stable TLS protocols (TLS 1.3), ensures users are able to take advantage of strong security capabilities and protects them from insecure legacy protocols. Every ssl_protocols (and proxy_ssl_protocols) directive must be exactly TLSv1.3, at least one ssl_protocols must exist, and when proxy_pass https:// is used proxy_ssl_protocols must be set. Evaluated on the merged configuration printed by `nginx -T` (all included files; needs permission to read them). CIS marks this recommendation Manual; the automated check implements its audit procedure.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

out=$(nginx -T 2>/dev/null) || exit 1; printf '%s\n' "$out" | awk '{l=$0; o=""; q=""; for(i=1;i<=length(l);i++){c=substr(l,i,1); if(q!=""){o=o c; if(c==q) q=""; continue} if(c=="\""||c=="\047"){q=c; o=o c; continue} if(c=="#") break; if(c==";"||c=="{"){print o c; o=""; continue} if(c=="}"){if(o~/[^[:space:]]/) print o; print "}"; o=""; continue} o=o c} if(o~/[^[:space:]]/) print o}' | awk 'function a(i,  x){x=$i; sub(/;$/,"",x); gsub(/["\047]/,"",x); return x} function inb(n,  i){for(i=1;i<=sp;i++) if(st[i]==n) return 1; return 0} $1=="ssl_protocols"{n++; if(NF!=2 || a(2)!="TLSv1.3") bad=1} $1=="proxy_ssl_protocols"{pp=1; if(NF!=2 || a(2)!="TLSv1.3") bad=1} $1=="proxy_pass" && a(2)~/^https:/ {hp=1} {o=gsub(/\{/,"{"); c=gsub(/\}/,"}"); while(o-->0){sp++; b=$1; sub(/\{.*/,"",b); st[sp]=b} while(c-->0 && sp>0) sp--} END{print (n>0&&!bad&&(!hp||pp))?"compliant":"noncompliant"}'

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Set 'ssl_protocols TLSv1.3;' in the http/server blocks and 'proxy_ssl_protocols TLSv1.3;' where proxying to TLS upstreams. Then run nginx -t and reload nginx.

Eigenschaften

Betriebssysteme: Beliebig
Tags: nginxtls
Referenz: CIS NGINX Benchmark v3.0.0 - 4.1.4 Ensure only modern TLS protocols are used

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target nginx