Ensure only required dynamic modules are loaded

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

1. Audit Dynamic Modules (Actionable): Run the following command to check for actively loaded dynamic modules: nginx -T 2>/dev/null | grep "load_module" Evaluation: If the output is empty, no dynamic modules are loaded (PASS). If output exists (e.g., load_module modules/ngx_http_geoip_module.so;), verify that each listed module is required for the application's business logic. 2. Audit Static Modules (Informational): Run the following command to list all modules compiled into the binary: nginx -V 2>&1 | grep -oEi '\-\-(with|without)-[^ ]*' Evaluation: Review the --with-...

修正方法

修正方法: ガイダンスまたは IaC パッチ

For Dynamic Modules: Open the main configuration file (/etc/nginx/nginx.conf) or the relevant include file (e.g., in /etc/nginx/modules-enabled/). Comment out or remove the load_module directive for any module that is not strictly necessary. For Static Modules: Since static modules cannot be removed from pre-built packages, ensure their directives are not used in your configuration. If a specific static module poses a critical risk to your environment, you must switch to a custom build or a different package flavor that excludes it.