STRT_Attack_Range_nginx.md

STRT Attack Range Nginx.conf

The following is the base nginx.conf file utilized to proxy to applications. Note the most important part is the logging kv, in which we log as much data with. This is CIM compliant and does map to the Splunk Web Datamodel.

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
        worker_connections 768;
        # multi_accept on;
}

http {

        ##
        # Basic Settings
        ##

        sendfile on;
        tcp_nopush on;
        types_hash_max_size 2048;
        # server_tokens off;

        # server_names_hash_bucket_size 64;
        # server_name_in_redirect off;
        client_body_in_file_only on;
        client_body_temp_path /opt/nginx/body 1 2;

        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        ##
        # SSL Settings
        ##

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
        ssl_prefer_server_ciphers on;

        ##
        # Logging Settings
        ##

            log_format kv 'site="$server_name" server="$host" dest_port="$server_port" dest_ip="$server_addr" '
                   'src="$remote_addr" src_ip="$realip_remote_addr" user="$remote_user" '
                   'time_local="$time_local" protocol="$server_protocol" status="$status" '
                   'bytes_out="$bytes_sent" bytes_in="$upstream_bytes_received" '
                   'http_referer="$http_referer" http_user_agent="$http_user_agent" '
                   'nginx_version="$nginx_version" http_x_forwarded_for="$http_x_forwarded_for" '
                   'http_x_header="$http_x_header" uri_query="$query_string" uri_path="$uri" '
                   'http_method="$request_method" response_time="$upstream_response_time" '
                   'cookie="$http_cookie" request_time="$request_time" category="$sent_http_content_type" https="$https" '
                   'request_body="$request_body" ';


        access_log /var/log/nginx/access.log kv;
        error_log /var/log/nginx/error.log;

        ##
        # Gzip Settings
        ##

        gzip on;

        # gzip_vary on;
        # gzip_proxied any;
        # gzip_comp_level 6;
        # gzip_buffers 16 8k;
        # gzip_http_version 1.1;
        # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

        ##
        # Virtual Host Configs
        ##

        include /etc/nginx/conf.d/*.conf;
        include /etc/nginx/sites-enabled/*;
}

Hosting a single Confluence Docker Container would be a new file under sites-available

server {
    listen 80;
    server_name confluence.< example >.com;

    access_log /var/log/nginx/confluence_access.log kv;
    error_log /var/log/nginx/confluence_error.log;

    location / {
        proxy_pass http://localhost:8090;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        client_max_body_size 100M;

        proxy_redirect off;
        proxy_buffering off;

        # WebSocket support (comment out if you don't need it)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}