vulncheck
49e7c55938
The bundled nginx met about half of the benchmark's Level 1 items: it answered for any Host, kept the 60-65 s default timeouts, allowed every method and 100 MB bodies everywhere, served config files 644 and sent no nosniff, Referrer-Policy or CSP on Next.js pages. Now nginx answers only for the names on the certificate (TLS_SERVER_NAMES, the DASHBOARD_URL host, localhost, 127.0.0.1, built by a new .envsh) and closes the connection for any other Host. No ssl_reject_handshake, since browsers send no SNI for an IP. TLS 1.3 only, with session tickets back on (4.1.11) and HSTS at two years. Timeouts are 10 s, methods are limited to what frontend and API use, bodies are 1 MB except 100 MB under /api/. /etc/nginx is 750/640, there is an error page without nginx branding, dot paths return 404 and X-Powered-By is hidden. The CSP is added only where the upstream sent none, so backend responses keep theirs. Clients without TLS 1.3 and Host names outside the list stop working. Both cases are documented in README and TROUBLESHOOTING. README.DEV.md maps every recommendation, including the Level 2 items not taken and why. Verified on the built image with nginx -t, the benchmark's curl audits and the login page under the CSP in a browser.
27 lines
858 B
Bash
27 lines
858 B
Bash
#!/bin/sh
|
|
# Sourced by the nginx entrypoint before it renders the templates. nginx
|
|
# answers for the names the certificate is issued for, the list of
|
|
# https_certificate_service.server_names(): TLS_SERVER_NAMES, the
|
|
# DASHBOARD_URL host, localhost, 127.0.0.1. Any other Host gets no answer
|
|
# (CIS 2.4.2); a missing name goes into TLS_SERVER_NAMES.
|
|
host=${DASHBOARD_URL#*://}
|
|
host=${host%%/*}
|
|
host=${host##*@}
|
|
case $host in
|
|
\[*) host="${host%%]*}]" ;;
|
|
*) host=${host%%:*} ;;
|
|
esac
|
|
|
|
# set -f: a wildcard name must not expand against the working directory.
|
|
set -f
|
|
names=
|
|
for n in $(echo "$TLS_SERVER_NAMES,$host,localhost,127.0.0.1" | tr 'A-Z,' 'a-z '); do
|
|
case " $names " in
|
|
*" $n "*) ;;
|
|
*) names="$names $n" ;;
|
|
esac
|
|
done
|
|
set +f
|
|
export TRUEVULN_SERVER_NAMES="${names# }"
|
|
echo "truevuln-tls: answering for $TRUEVULN_SERVER_NAMES"
|