Ensure only modern TLS protocols are used

YüksekDüzey 1Otomatiknginx

Açıklama

Only modern TLS protocols should be enabled in NGINX for all client connections and upstream connections. Removing legacy TLS and SSL protocols (SSL 3.0, TLS 1.0, 1.1 and 1.2), and enable stable TLS protocols (TLS 1.3), ensures users are able to take advantage of strong security capabilities and protects them from insecure legacy protocols. Every ssl_protocols (and proxy_ssl_protocols) directive must be exactly TLSv1.3, at least one ssl_protocols must exist, and when proxy_pass https:// is used proxy_ssl_protocols must be set. Evaluated on the merged configuration printed by `nginx -T` (all included files; needs permission to read them). CIS marks this recommendation Manual; the automated check implements its audit procedure.

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

out=$(nginx -T 2>/dev/null) || exit 1; printf '%s\n' "$out" | awk '{l=$0; o=""; q=""; for(i=1;i<=length(l);i++){c=substr(l,i,1); if(q!=""){o=o c; if(c==q) q=""; continue} if(c=="\""||c=="\047"){q=c; o=o c; continue} if(c=="#") break; if(c==";"||c=="{"){print o c; o=""; continue} if(c=="}"){if(o~/[^[:space:]]/) print o; print "}"; o=""; continue} o=o c} if(o~/[^[:space:]]/) print o}' | awk 'function a(i,  x){x=$i; sub(/;$/,"",x); gsub(/["\047]/,"",x); return x} function inb(n,  i){for(i=1;i<=sp;i++) if(st[i]==n) return 1; return 0} $1=="ssl_protocols"{n++; if(NF!=2 || a(2)!="TLSv1.3") bad=1} $1=="proxy_ssl_protocols"{pp=1; if(NF!=2 || a(2)!="TLSv1.3") bad=1} $1=="proxy_pass" && a(2)~/^https:/ {hp=1} {o=gsub(/\{/,"{"); c=gsub(/\}/,"}"); while(o-->0){sp++; b=$1; sub(/\{.*/,"",b); st[sp]=b} while(c-->0 && sp>0) sp--} END{print (n>0&&!bad&&(!hp||pp))?"compliant":"noncompliant"}'

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Set 'ssl_protocols TLSv1.3;' in the http/server blocks and 'proxy_ssl_protocols TLSv1.3;' where proxying to TLS upstreams. Then run nginx -t and reload nginx.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: nginxtls
Referans: CIS NGINX Benchmark v3.0.0 - 4.1.4 Ensure only modern TLS protocols are used

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target nginx