MISP
/
misp-docker
mirror of https://github.com/MISP/misp-docker
2
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #25 from seanthegeek/patch-2 

Improve security and privacy in nginx config
pull/1/head
Jason Kendall 2020-02-24 13:07:11 -05:00 committed by GitHub
parent 51b0c11c23 a8b43368b9
commit 555b8e4c64
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 31 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
server/files/etc/nginx/misp
View File

@ -1,26 +1,52 @@
server { server {
listen 80 default_server; listen 80 default_server;
listen [::]:80; listen [::]:80 default_server;
server_name _; # Disable access logs
access_log off;
log_not_found off;
error_log /dev/stderr error;
return 301 https://$host$request_uri; return 301 https://$host$request_uri;
} }
server { server {
listen 443 ssl http2;
server_name misp-server; listen [::]:443 ssl http2;
listen 443 ssl http2 spdy;
root /var/www/MISP/app/webroot; root /var/www/MISP/app/webroot;
index index.php; index index.php;
# Disable access logs
access_log off;
log_not_found off;
error_log /dev/stderr error;
ssl_certificate /etc/ssl/cert.pem; ssl_certificate /etc/ssl/cert.pem;
ssl_certificate_key /etc/ssl/key.pem; ssl_certificate_key /etc/ssl/key.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m; # about 40000 sessions
ssl_session_tickets off;
# modern configuration
ssl_protocols TLSv1.3;
ssl_prefer_server_ciphers off;
# enable HSTS # enable HSTS
add_header Strict-Transport-Security "max-age=15768000; includeSubdomains"; add_header Strict-Transport-Security "max-age=15768000; includeSubdomains";
add_header X-Frame-Options SAMEORIGIN; add_header X-Frame-Options SAMEORIGIN;
# Aded headers for hardening browser security
add_header Referrer-Policy "no-referrer" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Download-Options "noopen" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;
# Remove X-Powered-By, which is an information leak
fastcgi_hide_header X-Powered-By;
location / { location / {
try_files $uri $uri/ /index.php; try_files $uri $uri/ /index.php;
} }