Ensure HTTP Strict Transport Security (HSTS) is enabled

보통레벨 1자동nginx

설명

HTTP Strict Transport Security (HSTS) is a critical security header that instructs browsers to communicate with a domain exclusively over HTTPS. A comprehensive HSTS policy must include the includeSubDomains directive to apply the policy to all current and future subdomains. For maximum protection, the policy should also contain the preload directive, allowing the domain to be submitted to browser-pre-load lists. Every Strict-Transport-Security add_header must have max-age of at least 31536000, includeSubDomains and the always parameter. Evaluated on the merged configuration printed by `nginx -T` (all included files; needs permission to read them). CIS marks this recommendation Manual; the automated check implements its audit procedure.

점검 방법

감사 방식: 셸 명령

shell

out=$(nginx -T 2>/dev/null) || exit 1; printf '%s\n' "$out" | awk '{l=$0; o=""; q=""; for(i=1;i<=length(l);i++){c=substr(l,i,1); if(q!=""){o=o c; if(c==q) q=""; continue} if(c=="\""||c=="\047"){q=c; o=o c; continue} if(c=="#") break; if(c==";"||c=="{"){print o c; o=""; continue} if(c=="}"){if(o~/[^[:space:]]/) print o; print "}"; o=""; continue} o=o c} if(o~/[^[:space:]]/) print o}' | awk 'function a(i,  x){x=$i; sub(/;$/,"",x); gsub(/["\047]/,"",x); return x} function inb(n,  i){for(i=1;i<=sp;i++) if(st[i]==n) return 1; return 0} $1=="add_header" && tolower(a(2))=="strict-transport-security"{n++; l=tolower($0); m=0; if(match(l,/max-age=[0-9]+/)) m=substr(l,RSTART+8,RLENGTH-8)+0; if(m>=31536000 && l~/includesubdomains/ && a(NF)=="always") ok++} {o=gsub(/\{/,"{"); c=gsub(/\}/,"}"); while(o-->0){sp++; b=$1; sub(/\{.*/,"",b); st[sp]=b} while(c-->0 && sp>0) sp--} END{print (n>0&&ok==n)?"compliant":"noncompliant"}'

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always; Then run nginx -t and reload nginx.

속성

운영 체제: 모두
태그: nginxtls
참고 자료: CIS NGINX Benchmark v3.0.0 - 4.1.8 Ensure HTTP Strict Transport Security (HSTS) is enabled

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target nginx