Ensure HTTP is redirected to HTTPS

CaoCấp 1Tự độngnginx

Mô tả

Browsers and clients establish encrypted connections with servers by leveraging HTTPS. Requests leveraging HTTP are unencrypted. Unencrypted requests should be redirected so they are encrypted. Any listening HTTP port on your web server should redirect to a server profile that uses encryption. The default HTTP (unencrypted) port is 80. Every server block listening on plain port 80 must redirect with return 301/302/307/308 https://... or a rewrite to https:// (catch-all blocks may instead return a 4xx/444 code), and at least one TLS listener must exist. Evaluated on the merged configuration printed by `nginx -T` (all included files; needs permission to read them). CIS marks this recommendation Manual; the automated check implements its audit procedure.

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

out=$(nginx -T 2>/dev/null) || exit 1; printf '%s\n' "$out" | awk '{l=$0; o=""; q=""; for(i=1;i<=length(l);i++){c=substr(l,i,1); if(q!=""){o=o c; if(c==q) q=""; continue} if(c=="\""||c=="\047"){q=c; o=o c; continue} if(c=="#") break; if(c==";"||c=="{"){print o c; o=""; continue} if(c=="}"){if(o~/[^[:space:]]/) print o; print "}"; o=""; continue} o=o c} if(o~/[^[:space:]]/) print o}' | awk 'function a(i,  x){x=$i; sub(/;$/,"",x); gsub(/["\047]/,"",x); return x} function inb(n,  i){for(i=1;i<=sp;i++) if(st[i]==n) return 1; return 0} $1=="server" && /\{/ && !ins {ins=1; sd=sp+1; pl=0; rd=0} ins && $1=="listen" && $0!~/ssl/ && $0!~/quic/ && (a(2)~/(^|:)80$/ || a(2)=="80") {pl=1} $1=="listen" && ($0~/[[:space:]]ssl/ || $0~/quic/) {tls=1} ins && (($1=="return" && (a(2)~/^4[0-9][0-9]$/ || (a(2)~/^30[1278]$/ && a(3)~/^https:/))) || ($1=="rewrite" && a(3)~/^https:/)) {rd=1}  {o=gsub(/\{/,"{"); c=gsub(/\}/,"}"); while(o-->0){sp++; b=$1; sub(/\{.*/,"",b); st[sp]=b} while(c-->0 && sp>0) sp--} ins && sp<sd {ins=0; if(pl && !rd) bad=1} END{print (tls&&!bad)?"compliant":"noncompliant"}'

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

In each port-80 server block use 'return 301 https://$host$request_uri;'. Then run nginx -t and reload nginx.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: nginxtls
Tham chiếu: CIS NGINX Benchmark v3.0.0 - 4.1.1 Ensure HTTP is redirected to HTTPS

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target nginx