Ensure NGINX only listens for network connections on authorized ports

SedangLevel 1Tinjauan manualnginx

Deskripsi

NGINX should be configured to listen only on authorized ports and protocols. While traditional HTTP/1.1 and HTTP/2 use TCP ports 80 and 443, modern HTTP/3 (QUIC) utilizes UDP port 443. Ensuring that NGINX binds only to approved interfaces and ports minimizes the attack surface. Manual review: the benchmark gives no reliable automated check for this control.

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

1. Inspect Configuration: Run the following command to inspect all listen directives in the loaded configuration: nginx -T 2>/dev/null | grep -r "listen" Evaluation: Review the output for unauthorized ports. A modern secure configuration typically includes: listen 80; (TCP) - Often used only for redirecting to HTTPS. listen 443 ssl; (TCP) - For HTTP/1.1 and HTTP/2. listen 443 quic; (UDP) - For HTTP/3 (QUIC). Example Output: server { listen 80; listen 443 ssl; listen 443 quic reuseport; # HTTP/3 (UDP) ...

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Remove or comment out any listen directives that bind to unauthorized ports. For HTTP/3 (QUIC) Support: Ensure that you explicitly authorize and configure UDP port 443 in addition to TCP port 443. server { # Standard HTTPS (TCP) listen 443 ssl; # HTTP/3 (UDP) listen 443 quic reuseport; # ... SSL/TLS configuration ... }

Properti

Sistem operasi: Apa saja
Tag: nginxconfiguration
Referensi: CIS NGINX Benchmark v3.0.0 - 2.4.1 Ensure NGINX only listens for network connections on authorized ports