Ensure only required dynamic modules are loaded

보통레벨 1수동 검토nginx

설명

NGINX functionality is provided by modules. These modules are either compiled statically into the NGINX binary or loaded dynamically at runtime via the load_module directive. Static Modules: These are fixed at compile time. When using official pre-built packages (e.g., from nginx.org or OS vendors), a standard set of modules is included and cannot be removed without recompiling NGINX. Dynamic Modules ... Manual review: the benchmark gives no reliable automated check for this control.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

1. Audit Dynamic Modules (Actionable): Run the following command to check for actively loaded dynamic modules: nginx -T 2>/dev/null | grep "load_module" Evaluation: If the output is empty, no dynamic modules are loaded (PASS). If output exists (e.g., load_module modules/ngx_http_geoip_module.so;), verify that each listed module is required for the application's business logic. 2. Audit Static Modules (Informational): Run the following command to list all modules compiled into the binary: nginx -V 2>&1 | grep -oEi '\-\-(with|without)-[^ ]*' Evaluation: Review the --with-...

조치 방법

조치 방식: 가이드 또는 인프라 패치

For Dynamic Modules: Open the main configuration file (/etc/nginx/nginx.conf) or the relevant include file (e.g., in /etc/nginx/modules-enabled/). Comment out or remove the load_module directive for any module that is not strictly necessary. For Static Modules: Since static modules cannot be removed from pre-built packages, ensure their directives are not used in your configuration. If a specific static module poses a critical risk to your environment, you must switch to a custom build or a different package flavor that excludes it.

속성

운영 체제: 모두
태그: nginxconfiguration
참고 자료: CIS NGINX Benchmark v3.0.0 - 2.1.1 Ensure only required dynamic modules are loaded