From 07cbd8b84fbf63ef9dc934a4e0d490497b6b37c4 Mon Sep 17 00:00:00 2001
From: Sean Whalen <44679+seanthegeek@users.noreply.github.com>
Date: Sun, 23 Feb 2020 14:59:26 -0500
Subject: [PATCH 1/4] Improve security and privacy in nginx config

- Use modern protocols (TLSv1.3 and HTTTP2)
- Enable browser XSS prevention
- Disable `Referrer` headers (prevent information leaks)
- Prohibit search engine crawling
- Disable access logs
---
 server/files/etc/nginx/misp | 36 +++++++++++++++++++++++++++++++-----
 1 file changed, 31 insertions(+), 5 deletions(-)

diff --git a/server/files/etc/nginx/misp b/server/files/etc/nginx/misp
index 092710b..320c8bb 100644
--- a/server/files/etc/nginx/misp
+++ b/server/files/etc/nginx/misp
@@ -1,26 +1,52 @@
 server {
     listen 80 default_server;
-    listen [::]:80;
+    listen [::]:80 default_server;
 
-    server_name _;
+    # Disable access logs
+    access_log off;
+    log_not_found off;
+    error_log  /var/log/nginx/error.log error;
 
     return 301 https://$host$request_uri;
 }
 
 server {
-
-    server_name misp-server;
-    listen 443 ssl http2 spdy;
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
     root /var/www/MISP/app/webroot;
     index index.php;
 
+    # Disable access logs
+    access_log off;
+    log_not_found off;
+    error_log  /var/log/nginx/error.log error;
+
     ssl_certificate /etc/ssl/cert.pem;
     ssl_certificate_key /etc/ssl/key.pem;
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
+    ssl_session_tickets off;
+    
+    # modern configuration
+    ssl_protocols TLSv1.3;
+    ssl_prefer_server_ciphers off;
 
     # enable HSTS
     add_header Strict-Transport-Security "max-age=15768000; includeSubdomains";
     add_header X-Frame-Options SAMEORIGIN;
 
+    # Aded headers for hardening browser security
+    add_header Referrer-Policy "no-referrer" always;                                                 
+    add_header X-Content-Type-Options "nosniff" always;                                              
+    add_header X-Download-Options "noopen" always;                                                   
+    add_header X-Frame-Options "SAMEORIGIN" always;                                                  
+    add_header X-Permitted-Cross-Domain-Policies "none" always;                                     
+    add_header X-Robots-Tag "none" always;                                                           
+    add_header X-XSS-Protection "1; mode=block" always;                                              
+                                                                                                     
+    # Remove X-Powered-By, which is an information leak
+    fastcgi_hide_header X-Powered-By;
+
     location / {
         try_files $uri $uri/ /index.php;
     }

From e1af198d4c49a72359f3626407016186a297ee28 Mon Sep 17 00:00:00 2001
From: Sean Whalen <44679+seanthegeek@users.noreply.github.com>
Date: Sun, 23 Feb 2020 22:10:58 -0500
Subject: [PATCH 2/4] Forward nginx request and error logs to docker

---
 server/Dockerfile | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/server/Dockerfile b/server/Dockerfile
index 035c764..110127b 100644
--- a/server/Dockerfile
+++ b/server/Dockerfile
@@ -117,6 +117,11 @@ ARG PHP_VER
     # To use the scheduler worker for scheduled tasks, do the following:
         ;cp -fa /var/www/MISP/INSTALL/setup/config.php /var/www/MISP/app/Plugin/CakeResque/Config/config.php
 
+# Forward nginx request and error logs to docker log collector
+RUN ln -sf /dev/stdout /var/log/nginx/access.log \
+    && ln -sf /dev/stderr /var/log/nginx/error.log
+    RUN mkdir /wheels
+
 # nginx
     RUN rm /etc/nginx/sites-enabled/*; mkdir /run/php
     COPY files/etc/nginx/misp /etc/nginx/sites-enabled/misp

From 8198a6ededce03446f024b2506a401033030cb89 Mon Sep 17 00:00:00 2001
From: Sean Whalen <44679+seanthegeek@users.noreply.github.com>
Date: Mon, 24 Feb 2020 13:02:24 -0500
Subject: [PATCH 3/4] Revert log file linking

---
 server/Dockerfile | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/server/Dockerfile b/server/Dockerfile
index 110127b..035c764 100644
--- a/server/Dockerfile
+++ b/server/Dockerfile
@@ -117,11 +117,6 @@ ARG PHP_VER
     # To use the scheduler worker for scheduled tasks, do the following:
         ;cp -fa /var/www/MISP/INSTALL/setup/config.php /var/www/MISP/app/Plugin/CakeResque/Config/config.php
 
-# Forward nginx request and error logs to docker log collector
-RUN ln -sf /dev/stdout /var/log/nginx/access.log \
-    && ln -sf /dev/stderr /var/log/nginx/error.log
-    RUN mkdir /wheels
-
 # nginx
     RUN rm /etc/nginx/sites-enabled/*; mkdir /run/php
     COPY files/etc/nginx/misp /etc/nginx/sites-enabled/misp

From a8b43368b922df43d6871d38d0961956c6018b28 Mon Sep 17 00:00:00 2001
From: Sean Whalen <44679+seanthegeek@users.noreply.github.com>
Date: Mon, 24 Feb 2020 13:05:07 -0500
Subject: [PATCH 4/4] Write nginx errors to /dev/stderr

---
 server/files/etc/nginx/misp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/files/etc/nginx/misp b/server/files/etc/nginx/misp
index 320c8bb..ad0b715 100644
--- a/server/files/etc/nginx/misp
+++ b/server/files/etc/nginx/misp
@@ -5,7 +5,7 @@ server {
     # Disable access logs
     access_log off;
     log_not_found off;
-    error_log  /var/log/nginx/error.log error;
+    error_log  /dev/stderr error;
 
     return 301 https://$host$request_uri;
 }
@@ -19,7 +19,7 @@ server {
     # Disable access logs
     access_log off;
     log_not_found off;
-    error_log  /var/log/nginx/error.log error;
+    error_log  /dev/stderr error;
 
     ssl_certificate /etc/ssl/cert.pem;
     ssl_certificate_key /etc/ssl/key.pem;