Ensure NGINX only listens for network connections on authorized ports

OrtaDüzey 1Manuel incelemenginx

Açıklama

NGINX should be configured to listen only on authorized ports and protocols. While traditional HTTP/1.1 and HTTP/2 use TCP ports 80 and 443, modern HTTP/3 (QUIC) utilizes UDP port 443. Ensuring that NGINX binds only to approved interfaces and ports minimizes the attack surface. Manual review: the benchmark gives no reliable automated check for this control.

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

1. Inspect Configuration: Run the following command to inspect all listen directives in the loaded configuration: nginx -T 2>/dev/null | grep -r "listen" Evaluation: Review the output for unauthorized ports. A modern secure configuration typically includes: listen 80; (TCP) - Often used only for redirecting to HTTPS. listen 443 ssl; (TCP) - For HTTP/1.1 and HTTP/2. listen 443 quic; (UDP) - For HTTP/3 (QUIC). Example Output: server { listen 80; listen 443 ssl; listen 443 quic reuseport; # HTTP/3 (UDP) ...

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Remove or comment out any listen directives that bind to unauthorized ports. For HTTP/3 (QUIC) Support: Ensure that you explicitly authorize and configure UDP port 443 in addition to TCP port 443. server { # Standard HTTPS (TCP) listen 443 ssl; # HTTP/3 (UDP) listen 443 quic reuseport; # ... SSL/TLS configuration ... }

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: nginxconfiguration
Referans: CIS NGINX Benchmark v3.0.0 - 2.4.1 Ensure NGINX only listens for network connections on authorized ports