Ensure NGINX only listens for network connections on authorized ports

보통레벨 1수동 검토nginx

설명

NGINX should be configured to listen only on authorized ports and protocols. While traditional HTTP/1.1 and HTTP/2 use TCP ports 80 and 443, modern HTTP/3 (QUIC) utilizes UDP port 443. Ensuring that NGINX binds only to approved interfaces and ports minimizes the attack surface. Manual review: the benchmark gives no reliable automated check for this control.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

1. Inspect Configuration: Run the following command to inspect all listen directives in the loaded configuration: nginx -T 2>/dev/null | grep -r "listen" Evaluation: Review the output for unauthorized ports. A modern secure configuration typically includes: listen 80; (TCP) - Often used only for redirecting to HTTPS. listen 443 ssl; (TCP) - For HTTP/1.1 and HTTP/2. listen 443 quic; (UDP) - For HTTP/3 (QUIC). Example Output: server { listen 80; listen 443 ssl; listen 443 quic reuseport; # HTTP/3 (UDP) ...

조치 방법

조치 방식: 가이드 또는 인프라 패치

Remove or comment out any listen directives that bind to unauthorized ports. For HTTP/3 (QUIC) Support: Ensure that you explicitly authorize and configure UDP port 443 in addition to TCP port 443. server { # Standard HTTPS (TCP) listen 443 ssl; # HTTP/3 (UDP) listen 443 quic reuseport; # ... SSL/TLS configuration ... }

속성

운영 체제: 모두
태그: nginxconfiguration
참고 자료: CIS NGINX Benchmark v3.0.0 - 2.4.1 Ensure NGINX only listens for network connections on authorized ports