junlapong · June 14, 2019 01:17 · Jun 14, 2019 · Jun 14, 2019 · Jun 14, 2019 · Jun 14, 2019
diff --git a/_nginx-config.md b/_nginx-config.md
@@ -1,12 +1,18 @@
 # NGINX
 
-  /etc/init.d/nginx start|restart|reload
+```
+/etc/init.d/nginx start|restart|reload
+```
 
 ## CONFIG
 
-  /ect/nginx/nginx.conf
-  /ect/nginx/conf.d/*
+```
+/ect/nginx/nginx.conf
+/ect/nginx/conf.d/*
+```
 
 ### to generate your dhparam.pem file, run in the terminal
 
-  openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
+```
+openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
+```
diff --git a/@ nginx-config b/@ nginx-config
@@ -1,12 +0,0 @@
-##### NGINX #####
-
-$ /etc/init.d/nginx start|restart|reload
-
-### CONFIG ###
-/ect/nginx/nginx.conf
-/ect/nginx/conf.d/*
-
-
-# to generate your dhparam.pem file, run in the terminal
-openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
-

diff --git a/_nginx-config.md b/_nginx-config.md
@@ -0,0 +1,12 @@
+# NGINX
+
+  /etc/init.d/nginx start|restart|reload
+
+## CONFIG
+
+  /ect/nginx/nginx.conf
+  /ect/nginx/conf.d/*
+
+### to generate your dhparam.pem file, run in the terminal
+
+  openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
diff --git a/nginx-windows.md b/nginx-windows.md
@@ -0,0 +1,4 @@
+# NGINX for Windows
+
+ - http://nginx-win.ecsds.eu
+ - http://nginx-win.ecsds.eu/download
diff --git a/start.bat b/start.bat
@@ -0,0 +1,14 @@
+@echo off
+
+:: Start Nginx
+tasklist /FI "IMAGENAME eq nginx.exe" 2>NUL | find /I /N "nginx.exe">NUL
+
+IF NOT "%ERRORLEVEL%"=="0" (
+   :: Nginx is NOT running, so start it
+   c:
+   cd \nginx
+   start nginx.exe
+   echo Nginx started.
+) else (
+   echo Nginx is already running.
+)
diff --git a/nginx-config → @ nginx-config b/nginx-config → @ nginx-config
diff --git a/--- nginx-config --- → nginx-config b/--- nginx-config --- → nginx-config
diff --git a/nginx-config → --- nginx-config --- b/nginx-config → --- nginx-config ---
diff --git a/gistfile1.sh → nginx-config b/gistfile1.sh → nginx-config
diff --git a/header.conf b/header.conf
@@ -0,0 +1,6 @@
+##### HEADERS #####
+
+# $ apt-get install nginx-extras
+
+more_set_headers 'Server: BAY-WS';
+more_clear_headers 'ETag';
diff --git a/ip.conf b/ip.conf
@@ -0,0 +1,3 @@
+### NGINX get the real client IP for its access logs ###
+set_real_ip_from        127.0.0.1;
+real_ip_header          X-Forwarded-For;
diff --git a/security.conf b/security.conf
@@ -0,0 +1,5 @@
+server_tokens off;
+
+add_header X-Frame-Options SAMEORIGIN;
+add_header X-Content-Type-Options nosniff;
+add_header X-XSS-Protection "1; mode=block";
diff --git a/gistfile1.sh b/gistfile1.sh
@@ -1,2 +1,12 @@
+##### NGINX #####
+
+$ /etc/init.d/nginx start|restart|reload
+
+### CONFIG ###
+/ect/nginx/nginx.conf
+/ect/nginx/conf.d/*
+
+
 # to generate your dhparam.pem file, run in the terminal
 openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
+
diff --git a/nginx.conf b/nginx.conf
@@ -1,3 +1,5 @@
+#read more here http://tautt.com/best-nginx-configuration-for-security/
+
 #don't send the nginx version number in error pages and Server header
 server_tokens off;
 

diff --git a/nginx.conf b/nginx.conf
@@ -44,7 +44,6 @@ server {
 
   # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
   ssl_dhparam /etc/nginx/ssl/dhparam.pem;
-  ssl_session_timeout 5m;
 
   # enables server-side protection from BEAST attacks
   # http://blog.ivanristic.com/2013/09/is-beast-still-a-threat.html

diff --git a/nginx.conf b/nginx.conf
@@ -1,10 +1,6 @@
 #don't send the nginx version number in error pages and Server header
 server_tokens off;
 
-# config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
-# to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
-add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
-
 # config to don't allow the browser to render the page inside an frame or iframe
 # and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
 # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
@@ -65,6 +61,10 @@ server {
   ssl_stapling on;
   ssl_trusted_certificate /etc/nginx/ssl/star_forgott_com.crt;
 
+  # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
+  # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
+  add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
+
   #... the rest of your configuration
 }
 

diff --git a/gistfile1.sh b/gistfile1.sh
@@ -0,0 +1,2 @@
+# to generate your dhparam.pem file, run in the terminal
+openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
diff --git a/nginx.conf b/nginx.conf
@@ -43,8 +43,12 @@ server {
 
   # enable session resumption to improve https performance
   # http://vincent.bernat.im/en/blog/2011-ssl-session-reuse-rfc5077.html
-  ssl_session_cache shared:SSL:10m;
-  ssl_session_timeout 10m;
+  ssl_session_cache shared:SSL:50m;
+  ssl_session_timeout 5m;
+
+  # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
+  ssl_dhparam /etc/nginx/ssl/dhparam.pem;
+  ssl_session_timeout 5m;
 
   # enables server-side protection from BEAST attacks
   # http://blog.ivanristic.com/2013/09/is-beast-still-a-threat.html
@@ -53,7 +57,7 @@ server {
   ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
   # ciphers chosen for forward secrecy and compatibility
   # http://blog.ivanristic.com/2013/08/configuring-apache-nginx-and-openssl-for-forward-secrecy.html
-  ssl_ciphers 'EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS';
+  ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK';
 
   # enable ocsp stapling (mechanism by which a site can convey certificate revocation information to visitors in a privacy-preserving, scalable manner)
   # http://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/

diff --git a/nginx.conf b/nginx.conf
@@ -9,7 +9,7 @@ add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
 # and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
 # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
 # https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
-add_header X-Frame-Options DENY;
+add_header X-Frame-Options SAMEORIGIN;
 
 # when serving user-supplied content, include a X-Content-Type-Options: nosniff header along with the Content-Type: header,
 # to disable content-type sniffing on some browsers.

diff --git a/nginx.conf b/nginx.conf
@@ -11,6 +11,20 @@ add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
 # https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
 add_header X-Frame-Options DENY;
 
+# when serving user-supplied content, include a X-Content-Type-Options: nosniff header along with the Content-Type: header,
+# to disable content-type sniffing on some browsers.
+# https://www.owasp.org/index.php/List_of_useful_HTTP_headers
+# currently suppoorted in IE > 8 http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx
+# http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx
+# 'soon' on Firefox https://bugzilla.mozilla.org/show_bug.cgi?id=471020
+add_header X-Content-Type-Options nosniff;
+
+# This header enables the Cross-site scripting (XSS) filter built into most recent web browsers.
+# It's usually enabled by default anyway, so the role of this header is to re-enable the filter for 
+# this particular website if it was disabled by the user.
+# https://www.owasp.org/index.php/List_of_useful_HTTP_headers
+add_header X-XSS-Protection "1; mode=block";
+
 # with Content Security Policy (CSP) enabled(and a browser that supports it(http://caniuse.com/#feat=contentsecuritypolicy),
 # you can tell the browser that it can only download content from the domains you explicitly allow
 # http://www.html5rocks.com/en/tutorials/security/content-security-policy/

diff --git a/nginx.conf b/nginx.conf
@@ -16,7 +16,8 @@ add_header X-Frame-Options DENY;
 # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
 # https://www.owasp.org/index.php/Content_Security_Policy
 # I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval'
-# directives for css and js. more: http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
+# directives for css and js(if you have inline css or js, you will need to keep it too).
+# more: http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
 add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";
 
 server {

diff --git a/nginx.conf b/nginx.conf
@@ -16,8 +16,7 @@ add_header X-Frame-Options DENY;
 # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
 # https://www.owasp.org/index.php/Content_Security_Policy
 # I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval'
-# directives for css and js
-# http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
+# directives for css and js. more: http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
 add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";
 
 server {

diff --git a/nginx.conf b/nginx.conf
@@ -15,7 +15,8 @@ add_header X-Frame-Options DENY;
 # you can tell the browser that it can only download content from the domains you explicitly allow
 # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
 # https://www.owasp.org/index.php/Content_Security_Policy
-# I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval' directives
+# I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval'
+# directives for css and js
 # http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
 add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";
 

diff --git a/nginx.conf b/nginx.conf
@@ -15,9 +15,9 @@ add_header X-Frame-Options DENY;
 # you can tell the browser that it can only download content from the domains you explicitly allow
 # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
 # https://www.owasp.org/index.php/Content_Security_Policy
-# I've disabled it since it have some restrictions, like not executing inline JS anymore
+# I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval' directives
 # http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
-# add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://ssl.google-analytics.com https://assets.zendesk.com; img-src 'self' https://ssl.google-analytics.com; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://themes.googleusercontent.com; frame-src 'none'; object-src 'none'";
+add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";
 
 server {
   listen 443 ssl default deferred;

diff --git a/nginx.conf b/nginx.conf
@@ -15,8 +15,8 @@ add_header X-Frame-Options DENY;
 # you can tell the browser that it can only download content from the domains you explicitly allow
 # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
 # https://www.owasp.org/index.php/Content_Security_Policy
-# I've disabled it since it have some restrictions, like not executing inline JS in Chrome
-# https://developer.chrome.com/extensions/contentSecurityPolicy.html#JSExecution
+# I've disabled it since it have some restrictions, like not executing inline JS anymore
+# http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
 # add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://ssl.google-analytics.com https://assets.zendesk.com; img-src 'self' https://ssl.google-analytics.com; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://themes.googleusercontent.com; frame-src 'none'; object-src 'none'";
 
 server {

diff --git a/nginx.conf b/nginx.conf
@@ -15,9 +15,9 @@ add_header X-Frame-Options DENY;
 # you can tell the browser that it can only download content from the domains you explicitly allow
 # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
 # https://www.owasp.org/index.php/Content_Security_Policy
-add_header X-Content-Security-Policy "default-src 'self'; \
-script-src 'self' https://ssl.google-analytics.com; \
-img-src 'self' https://ssl.google-analytics.com";
+# I've disabled it since it have some restrictions, like not executing inline JS in Chrome
+# https://developer.chrome.com/extensions/contentSecurityPolicy.html#JSExecution
+# add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://ssl.google-analytics.com https://assets.zendesk.com; img-src 'self' https://ssl.google-analytics.com; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://themes.googleusercontent.com; frame-src 'none'; object-src 'none'";
 
 server {
   listen 443 ssl default deferred;

diff --git a/nginx.conf b/nginx.conf
@@ -4,12 +4,21 @@ server_tokens off;
 # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
 # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
 add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
+
 # config to don't allow the browser to render the page inside an frame or iframe
 # and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
 # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
 # https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
 add_header X-Frame-Options DENY;
 
+# with Content Security Policy (CSP) enabled(and a browser that supports it(http://caniuse.com/#feat=contentsecuritypolicy),
+# you can tell the browser that it can only download content from the domains you explicitly allow
+# http://www.html5rocks.com/en/tutorials/security/content-security-policy/
+# https://www.owasp.org/index.php/Content_Security_Policy
+add_header X-Content-Security-Policy "default-src 'self'; \
+script-src 'self' https://ssl.google-analytics.com; \
+img-src 'self' https://ssl.google-analytics.com";
+
 server {
   listen 443 ssl default deferred;
   server_name .forgott.com;

diff --git a/nginx.conf b/nginx.conf
@@ -44,5 +44,5 @@ server {
 server {
   listen 80;
   server_name .forgott.com;
-  rewrite ^(.*)$ https://$host$request_uri permanent;
+  rewrite ^ https://$host$request_uri permanent;
 }
diff --git a/nginx.conf b/nginx.conf
@@ -40,11 +40,9 @@ server {
   #... the rest of your configuration
 }
 
+# redirect all http traffic to https
 server {
   listen 80;
   server_name .forgott.com;
-
-  # redirect all http traffic to https
   rewrite ^(.*)$ https://$host$request_uri permanent;
-  break;
 }
diff --git a/nginx.conf b/nginx.conf
@@ -38,4 +38,13 @@ server {
   ssl_trusted_certificate /etc/nginx/ssl/star_forgott_com.crt;
 
   #... the rest of your configuration
-}
+}
+
+server {
+  listen 80;
+  server_name .forgott.com;
+
+  # redirect all http traffic to https
+  rewrite ^(.*)$ https://$host$request_uri permanent;
+  break;
+}
diff --git a/nginx.conf b/nginx.conf
@@ -3,7 +3,7 @@ server_tokens off;
 
 # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
 # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
-add_header Strict-Transport-Security max-age=31536000;
+add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
 # config to don't allow the browser to render the page inside an frame or iframe
 # and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
 # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
@@ -37,6 +37,5 @@ server {
   ssl_stapling on;
   ssl_trusted_certificate /etc/nginx/ssl/star_forgott_com.crt;
 
-
   #... the rest of your configuration
 }
diff --git a/nginx.conf b/nginx.conf
@@ -1,8 +1,18 @@
+#don't send the nginx version number in error pages and Server header
+server_tokens off;
+
+# config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
+# to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
+add_header Strict-Transport-Security max-age=31536000;
+# config to don't allow the browser to render the page inside an frame or iframe
+# and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
+# if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
+# https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
+add_header X-Frame-Options DENY;
+
 server {
   listen 443 ssl default deferred;
   server_name .forgott.com;
-  #don't send the nginx version number in error pages and Server header
-  server_tokens off;
 
   ssl_certificate /etc/nginx/ssl/star_forgott_com.crt;
   ssl_certificate_key /etc/nginx/ssl/star_forgott_com.key;
@@ -27,13 +37,6 @@ server {
   ssl_stapling on;
   ssl_trusted_certificate /etc/nginx/ssl/star_forgott_com.crt;
 
-  # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
-  # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
-  add_header Strict-Transport-Security max-age=31536000;
-  # config to don't allow the browser to render the page inside an frame or iframe
-  # and avoid clickjacking https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
-  # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
-  add_header X-Frame-Options DENY;
 
   #... the rest of your configuration
 }
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		# to generate your dhparam.pem file, run in the terminal
		openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048