我对Nginx的配置感到陌生，它是内部Web服务的代理，需要使用SSL连接进行转发。
该设置当前涉及服务一个内部Web应用程序，该应用程序当前正在公共云基础结构上运行。
下面是我的string salt = CryptSharp.Crypter.Phpass.GenerateSalt(8);
配置：
public static bool ValidatePassword(string pass, string passCriptat, string salt)
{
string CryptedInput = CryptSharp.Crypter.Phpass.Crypt(Encoding.ASCII.GetBytes(pass), salt);
string CryptedPassword = CryptSharp.Crypter.Phpass.Crypt(Encoding.ASCII.GetBytes(passCriptat), salt);
return string.Equals(CryptedInput, CryptedPassword);
}
我在其中为服务器生成了自签名证书：nginx，并在其中输入了相应的密钥：server {
listen 80 default_server;
listen [::]:80 default_server;
server_name www.somedomain.com;
# Refer:
# https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/
# Discourage deep links by using a permanent redirect to home page of HTTPS site
return 301 https://$server_name;
}
server {
# User Defined
listen 443 ssl http2;
# SSL Certificate Paths
ssl_certificate /home/secured/ssl/certs/mycustomapp.cert;
ssl_certificate_key /home/secured/ssl/private/mycustomapp.key;
# Nginx Access and Error Logs
access_log /var/log/nginx/mycustomapp.access.log;
error_log /var/log/nginx/mycustomapp.error.log;
# Add index.php to the list if you are using PHP
index index.html index.htm index.nginx-debian.html;
# User Defined
server_name www.somedomain.com;
# HSTS header for always https option
add_header Strict-Transport-Security "max-age=36000; includeSubDomains" always;
add_header X-Frame-Options "DENY";
location / {
# User Defined
include /etc/nginx/proxy_params;
proxy_pass http://localhost:9090;
proxy_read_timeout 90s;
proxy_redirect http://localhost:9090 https://$server_name;
}
}
，并且本地服务/应用程序正在mycustomapp.cert上运行，并且不是在全局访问端口mycustomapp.key上运行。
以下是此位置http://localhost:9090上可用的0.0.0.0:9090的摘要。
access.log我还在/var/log/nginx/和106.51.17.223 - - [23/Dec/2018:17:51:22 +0000] "GET / HTTP/1.1" 301 194 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36"
47.75.165.214 - - [23/Dec/2018:18:16:47 +0000] "PROPFIND / HTTP/1.1" 301 194 "-" "-"
47.75.165.214 - - [23/Dec/2018:18:16:47 +0000] "GET /webdav/ HTTP/1.1" 301 194 "-" "Mozilla/5.0"
47.75.165.214 - - [23/Dec/2018:18:16:47 +0000] "GET /help.php HTTP/1.1" 301 194 "-" "Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0"
47.75.165.214 - - [23/Dec/2018:18:16:48 +0000] "GET /java.php HTTP/1.1" 301 194 "-" "Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0"
47.75.165.214 - - [23/Dec/2018:18:16:58 +0000] "POST /wuwu11.php HTTP/1.1" 301 194 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
47.75.165.214 - - [23/Dec/2018:18:16:58 +0000] "POST /xw.php HTTP/1.1" 301 194 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
47.75.165.214 - - [23/Dec/2018:18:16:59 +0000] "POST /xw1.php HTTP/1.1" 301 194 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
47.75.165.214 - - [23/Dec/2018:18:16:59 +0000] "POST /9678.php HTTP/1.1" 301 194 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
中都观察到了一些格式错误的请求（此处未复制）。
该配置是否足以延迟/阻止这些渗透攻击尝试，或者是否有冗余配置正在暴露我目前无法理解的通道？
当前，当有人需要访问权限时，我会启用该服务，但随着越来越多的人开始使用该应用程序，这是不适合的情况。
答案 0 :(得分：1)
此配置照常就足够了。要获得更多安全性，请查看以下列表：