Ensure only modern TLS protocols are used

ÉlevéeNiveau 1Automatiséenginx

Description

Only modern TLS protocols should be enabled in NGINX for all client connections and upstream connections. Removing legacy TLS and SSL protocols (SSL 3.0, TLS 1.0, 1.1 and 1.2), and enable stable TLS protocols (TLS 1.3), ensures users are able to take advantage of strong security capabilities and protects them from insecure legacy protocols. Every ssl_protocols (and proxy_ssl_protocols) directive must be exactly TLSv1.3, at least one ssl_protocols must exist, and when proxy_pass https:// is used proxy_ssl_protocols must be set. Evaluated on the merged configuration printed by `nginx -T` (all included files; needs permission to read them). CIS marks this recommendation Manual; the automated check implements its audit procedure.

Méthode de vérification

Méthode d'audit: Commande shell

shell

out=$(nginx -T 2>/dev/null) || exit 1; printf '%s\n' "$out" | awk '{l=$0; o=""; q=""; for(i=1;i<=length(l);i++){c=substr(l,i,1); if(q!=""){o=o c; if(c==q) q=""; continue} if(c=="\""||c=="\047"){q=c; o=o c; continue} if(c=="#") break; if(c==";"||c=="{"){print o c; o=""; continue} if(c=="}"){if(o~/[^[:space:]]/) print o; print "}"; o=""; continue} o=o c} if(o~/[^[:space:]]/) print o}' | awk 'function a(i,  x){x=$i; sub(/;$/,"",x); gsub(/["\047]/,"",x); return x} function inb(n,  i){for(i=1;i<=sp;i++) if(st[i]==n) return 1; return 0} $1=="ssl_protocols"{n++; if(NF!=2 || a(2)!="TLSv1.3") bad=1} $1=="proxy_ssl_protocols"{pp=1; if(NF!=2 || a(2)!="TLSv1.3") bad=1} $1=="proxy_pass" && a(2)~/^https:/ {hp=1} {o=gsub(/\{/,"{"); c=gsub(/\}/,"}"); while(o-->0){sp++; b=$1; sub(/\{.*/,"",b); st[sp]=b} while(c-->0 && sp>0) sp--} END{print (n>0&&!bad&&(!hp||pp))?"compliant":"noncompliant"}'

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Set 'ssl_protocols TLSv1.3;' in the http/server blocks and 'proxy_ssl_protocols TLSv1.3;' where proxying to TLS upstreams. Then run nginx -t and reload nginx.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: nginxtls
Référence: CIS NGINX Benchmark v3.0.0 - 4.1.4 Ensure only modern TLS protocols are used

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target nginx