nbeguier’s gists

nbeguier / nginx.conf

Last active May 2, 2021 13:58

[DEPRECATED] Nginx : BREACH protection

	# Disable gzip compression
	gzip off;

nbeguier / nginx.conf

Last active January 4, 2021 13:43

Nginx : Logjam protection

	# LOGJAM protection ## All TLS accepted, EECDH/EDH key exchange ciphers, force cipher order and use of 4096-bits group DH
	# Updated 04/01/2021
	ssl_protocols TLSv1.2 TLSv1.3;
	ssl_ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA;
	ssl_prefer_server_ciphers on;
	ssl_dhparam /etc/ssl/certs/dhparam.pem;

nbeguier / nginx.conf

Last active January 4, 2021 13:47

[DEPRECATED] Nginx : BEAST & RC4

	# BEAST protection
	## Remove TLSv1.0
	ssl_protocols TLSv1.1 TLSv1.2;

	# BEAST protection, NO RC4 protection
	## Allow TLSv1.0 and force RC4
	ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
	ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:EDH+aRSA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:RC4:!SEED;

	# NO BEAST protection, RC4 protection

nbeguier / nginx.conf

Last active June 22, 2022 10:21

Nginx : Cipher Suite

	# Updated 04/01/2021

	# Best ratio Security/Accessibility
	ssl_ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA;

	# Most secured
	ssl_ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384;

nbeguier / nginx.conf

Last active January 4, 2021 13:27

Nginx : Enable only TLS

	# POODLE protection
	## Remove SSLv3 and SSLv2 is mandatory
	## Remove TLS1.0 and TLS1.1 is better
	ssl_protocols TLSv1.2 TLSv1.3;

nbeguier / nginx.conf

Last active January 4, 2021 13:24

Nginx : ETag and Anti-clickjacking

	# Server leaks inodes via diable ETags
	etag off;

	# Anti-clickjacking X-Frame-Options header
	add_header X-Frame-Options "SAMEORIGIN";

nbeguier / nginx.conf

Created September 7, 2018 12:49

Nginx : enable HSTS

	# Force HTTPs connexion max age to 180 days
	## Strict Transport Security (HSTS): Yes
	add_header Strict-Transport-Security "max-age=15552001; includeSubdomains; preload";

nbeguier / nginx.conf

Created September 7, 2018 12:48

Nginx : Hide version

	# Only return Nginx in server header
	server_tokens off;

nbeguier / apache2.conf

Last active January 2, 2024 15:06

Apache : Secure configuration

	# Hide server version on error pages
	ServerSignature Off
	# Only return Apache in server header
	ServerTokens Prod

	<VirtualHost *:443>
	ServerName mywebserver.domain.net
	DocumentRoot /var/www/web
	SSLEngine on
	SSLCertificateFile /etc/apache2/ssl/server.pem

nbeguier / apache2.conf

Created September 5, 2018 18:24

Apache : CRIME protection

Nicolas Béguier nbeguier