Ensure NGINX only listens for network connections on authorized ports

中レベル 1手動レビューnginx

説明

NGINX should be configured to listen only on authorized ports and protocols. While traditional HTTP/1.1 and HTTP/2 use TCP ports 80 and 443, modern HTTP/3 (QUIC) utilizes UDP port 443. Ensuring that NGINX binds only to approved interfaces and ports minimizes the attack surface. Manual review: the benchmark gives no reliable automated check for this control.

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

1. Inspect Configuration: Run the following command to inspect all listen directives in the loaded configuration: nginx -T 2>/dev/null | grep -r "listen" Evaluation: Review the output for unauthorized ports. A modern secure configuration typically includes: listen 80; (TCP) - Often used only for redirecting to HTTPS. listen 443 ssl; (TCP) - For HTTP/1.1 and HTTP/2. listen 443 quic; (UDP) - For HTTP/3 (QUIC). Example Output: server { listen 80; listen 443 ssl; listen 443 quic reuseport; # HTTP/3 (UDP) ...

修正方法

修正方法: ガイダンスまたは IaC パッチ

Remove or comment out any listen directives that bind to unauthorized ports. For HTTP/3 (QUIC) Support: Ensure that you explicitly authorize and configure UDP port 443 in addition to TCP port 443. server { # Standard HTTPS (TCP) listen 443 ssl; # HTTP/3 (UDP) listen 443 quic reuseport; # ... SSL/TLS configuration ... }

プロパティ

オペレーティングシステム: すべて
タグ: nginxconfiguration
参照: CIS NGINX Benchmark v3.0.0 - 2.4.1 Ensure NGINX only listens for network connections on authorized ports