Ensure only modern TLS protocols are used

VisokaNivo 1Automatskanginx

Opis

Only modern TLS protocols should be enabled in NGINX for all client connections and upstream connections. Removing legacy TLS and SSL protocols (SSL 3.0, TLS 1.0, 1.1 and 1.2), and enable stable TLS protocols (TLS 1.3), ensures users are able to take advantage of strong security capabilities and protects them from insecure legacy protocols. Every ssl_protocols (and proxy_ssl_protocols) directive must be exactly TLSv1.3, at least one ssl_protocols must exist, and when proxy_pass https:// is used proxy_ssl_protocols must be set. Evaluated on the merged configuration printed by `nginx -T` (all included files; needs permission to read them). CIS marks this recommendation Manual; the automated check implements its audit procedure.

Kako se proverava

Metod provere: Komanda ljuske

shell

out=$(nginx -T 2>/dev/null) || exit 1; printf '%s\n' "$out" | awk '{l=$0; o=""; q=""; for(i=1;i<=length(l);i++){c=substr(l,i,1); if(q!=""){o=o c; if(c==q) q=""; continue} if(c=="\""||c=="\047"){q=c; o=o c; continue} if(c=="#") break; if(c==";"||c=="{"){print o c; o=""; continue} if(c=="}"){if(o~/[^[:space:]]/) print o; print "}"; o=""; continue} o=o c} if(o~/[^[:space:]]/) print o}' | awk 'function a(i,  x){x=$i; sub(/;$/,"",x); gsub(/["\047]/,"",x); return x} function inb(n,  i){for(i=1;i<=sp;i++) if(st[i]==n) return 1; return 0} $1=="ssl_protocols"{n++; if(NF!=2 || a(2)!="TLSv1.3") bad=1} $1=="proxy_ssl_protocols"{pp=1; if(NF!=2 || a(2)!="TLSv1.3") bad=1} $1=="proxy_pass" && a(2)~/^https:/ {hp=1} {o=gsub(/\{/,"{"); c=gsub(/\}/,"}"); while(o-->0){sp++; b=$1; sub(/\{.*/,"",b); st[sp]=b} while(c-->0 && sp>0) sp--} END{print (n>0&&!bad&&(!hp||pp))?"compliant":"noncompliant"}'

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Set 'ssl_protocols TLSv1.3;' in the http/server blocks and 'proxy_ssl_protocols TLSv1.3;' where proxying to TLS upstreams. Then run nginx -t and reload nginx.

Svojstva

Operativni sistemi: Bilo koji
Oznake: nginxtls
Referenca: CIS NGINX Benchmark v3.0.0 - 4.1.4 Ensure only modern TLS protocols are used

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target nginx