Merge branch 'migrate_nginx' into collection
This commit is contained in:
Sebastian Gumprich committed
commit
cc48e4761a
8 files changed
+340
No files matched your search
@@ -0,0 +1,65 @@
|
||||
# Changelog
|
||||
|
||||
## [2.1.0](https://github.com/dev-sec/ansible-nginx-hardening/tree/2.1.0) (2018-11-18)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-nginx-hardening/compare/2.0.0...2.1.0)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- add ubuntu 18.04 support [\#20](https://github.com/dev-sec/ansible-nginx-hardening/pull/20) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- updated minimum required ansible version to 2.5 in README, as the used 'loop' keyword was introduced in version 2.5 [\#19](https://github.com/dev-sec/ansible-nginx-hardening/pull/19) ([szEvEz](https://github.com/szEvEz))
|
||||
|
||||
## [2.0.0](https://github.com/dev-sec/ansible-nginx-hardening/tree/2.0.0) (2018-09-08)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-nginx-hardening/compare/1.0.2...2.0.0)
|
||||
|
||||
**Implemented enhancements:**
|
||||
|
||||
- Update readme to include baselines [\#10](https://github.com/dev-sec/ansible-nginx-hardening/issues/10)
|
||||
- Update testing, remove useless params, style update [\#18](https://github.com/dev-sec/ansible-nginx-hardening/pull/18) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- Update README.md [\#14](https://github.com/dev-sec/ansible-nginx-hardening/pull/14) ([vishesh92](https://github.com/vishesh92))
|
||||
- Add comment filter to {{ansible\_managed}} string [\#12](https://github.com/dev-sec/ansible-nginx-hardening/pull/12) ([fazlearefin](https://github.com/fazlearefin))
|
||||
- use new Docker images [\#8](https://github.com/dev-sec/ansible-nginx-hardening/pull/8) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- Running kitchen verify asks for 'roots' password [\#11](https://github.com/dev-sec/ansible-nginx-hardening/issues/11)
|
||||
- Fix duplicate ssl\_prefer\_server\_ciphers error [\#16](https://github.com/dev-sec/ansible-nginx-hardening/pull/16) ([oakey-b1](https://github.com/oakey-b1))
|
||||
|
||||
## [1.0.2](https://github.com/dev-sec/ansible-nginx-hardening/tree/1.0.2) (2016-10-24)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-nginx-hardening/compare/1.0.1...1.0.2)
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- Syntax Error while loading YAML in defaults/main.yml [\#6](https://github.com/dev-sec/ansible-nginx-hardening/issues/6)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- remove tabs. fix \#6 [\#7](https://github.com/dev-sec/ansible-nginx-hardening/pull/7) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
|
||||
## [1.0.1](https://github.com/dev-sec/ansible-nginx-hardening/tree/1.0.1) (2016-09-23)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-nginx-hardening/compare/1.0.0...1.0.1)
|
||||
|
||||
**Fixed bugs:**
|
||||
|
||||
- ssl\_dhparam [\#4](https://github.com/dev-sec/ansible-nginx-hardening/issues/4)
|
||||
|
||||
**Closed issues:**
|
||||
|
||||
- Make the owner /etc/nginx configurabe [\#3](https://github.com/dev-sec/ansible-nginx-hardening/issues/3)
|
||||
- Running worker process as non-privileged user \(1 failed\) [\#2](https://github.com/dev-sec/ansible-nginx-hardening/issues/2)
|
||||
|
||||
**Merged pull requests:**
|
||||
|
||||
- create dhparam file. fix \#4 [\#5](https://github.com/dev-sec/ansible-nginx-hardening/pull/5) ([rndmh3ro](https://github.com/rndmh3ro))
|
||||
- improve gemfile, update readme for local tests [\#1](https://github.com/dev-sec/ansible-nginx-hardening/pull/1) ([chris-rock](https://github.com/chris-rock))
|
||||
|
||||
## [1.0.0](https://github.com/dev-sec/ansible-nginx-hardening/tree/1.0.0) (2016-08-11)
|
||||
|
||||
[Full Changelog](https://github.com/dev-sec/ansible-nginx-hardening/compare/1b9dcf16cfbf45ff5f50cd83509245d1527f9fd0...1.0.0)
|
||||
|
||||
|
||||
|
||||
\* *This Changelog was automatically generated by [github_changelog_generator](https://github.com/github-changelog-generator/github-changelog-generator)*
|
||||
@@ -0,0 +1,104 @@
|
||||
# devsec.nginx_hardening
|
||||
|
||||
|
||||
|
||||
## Description
|
||||
|
||||
This role provides secure nginx configuration. It is intended to be compliant with the [DevSec Nginx Baseline](https://github.com/dev-sec/nginx-baseline).
|
||||
|
||||
It works with the following nginx-roles, including, but not limited to:
|
||||
* [geerlingguy.nginx](https://galaxy.ansible.com/geerlingguy/nginx/)
|
||||
* [nginxinc.nginx](https://galaxy.ansible.com/nginxinc/nginx)
|
||||
* [jdauphant.nginx](https://galaxy.ansible.com/jdauphant/nginx/)
|
||||
* [franklinkim.nginx](https://galaxy.ansible.com/franklinkim/nginx/)
|
||||
|
||||
**NOTE: This role does not work with nginx 1.0.15 or older! Please use the latest version from the official nginx repositories!**
|
||||
|
||||
## Requirements
|
||||
|
||||
* Ansible >= 2.9
|
||||
|
||||
## Role Variables
|
||||
|
||||
* [nginx_client_body_buffer_size][]
|
||||
* Default: `1k`
|
||||
* Description: Sets buffer size for reading client request body. In case the request body is larger than the buffer, the whole body or only its part is written to a temporary file.
|
||||
* nginx_remove_default_site
|
||||
* Default: `true`
|
||||
* Description: Disables the default site. Set to false to enable the default site in nginx.
|
||||
* [nginx_client_max_body_size][]
|
||||
* Default: `1k`
|
||||
* Description: Sets the maximum allowed size of the client request body, specified in the “Content-Length” request header field. If the size in a request exceeds the configured value, the 41
|
||||
3 (Request Entity Too Large) error is returned to the client.
|
||||
* [nginx_keepalive_timeout][]
|
||||
* Default: `5 5`
|
||||
* Description: The first parameter sets a timeout during which a keep-alive client connection will stay open on the server side. The zero value disables keep-alive client connections. The op
|
||||
tional second parameter sets a value in the “Keep-Alive: timeout=time” response header field.
|
||||
* [nginx_server_tokens][]
|
||||
* Default: `off`
|
||||
* Description: Disables emitting nginx version in error messages and in the "Server" response header field. Set to on to enable the nginx version in error messages and "Server" response head
|
||||
er.
|
||||
* [nginx_client_header_buffer_size][]
|
||||
* Default: `1k`
|
||||
* Description: Sets buffer size for reading client request header. For most requests, a buffer of 1K bytes is enough.
|
||||
* [nginx_large_client_header_buffers][]
|
||||
* Default: `2 1k`
|
||||
* Description: Sets the maximum number and size of buffers used for reading large client request header.
|
||||
* [nginx_client_body_timeout][]
|
||||
* Default: `10`
|
||||
* Description: Defines a timeout for reading client request body.
|
||||
* [nginx_client_header_timeout][]
|
||||
* Default: `10`
|
||||
* Description: Defines a timeout for reading client request header.
|
||||
* [nginx_send_timeout][]
|
||||
* Default: `10`
|
||||
* Description: Sets a timeout for transmitting a response to the client.
|
||||
* [nginx_limit_conn_zone][]
|
||||
* Default: `$binary_remote_addr zone=default:10m`
|
||||
* Description: Sets parameters for a shared memory zone that will keep states for various keys.
|
||||
* [nginx_limit_conn][]
|
||||
* Default: `default 5`
|
||||
* Description: Sets the shared memory zone and the maximum allowed number of connections for a given key value.
|
||||
* [nginx_add_header][]
|
||||
* Default: `[ "X-Frame-Options SAMEORIGIN", "X-Content-Type-Options nosniff", "X-XSS-Protection \"1; mode=block\"" ]`
|
||||
* Description:Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307.
|
||||
* [nginx_ssl_protocols][]
|
||||
* Default: `TLSv1.2`
|
||||
* Description: Specifies the SSL protocol which should be used.
|
||||
* [nginx_ssl_ciphers][]
|
||||
* Default: *see defaults.yml*
|
||||
* Description: Specifies the TLS ciphers which should be used.
|
||||
* [nginx_ssl_prefer_server_ciphers][]
|
||||
* Default: `on`
|
||||
* Description: Specifies that server ciphers should be preferred over client ciphers when using the TLS protocols. Set to false to disable it.
|
||||
* [nginx_dh_size][]
|
||||
* Default: `2048`
|
||||
* Description: Specifies the length of DH parameters for EDH ciphers.
|
||||
|
||||
## Example Playbook
|
||||
|
||||
```
|
||||
- hosts: localhost
|
||||
collections:
|
||||
- devsec.hardening
|
||||
roles:
|
||||
- devsec.nginx_hardening
|
||||
```
|
||||
|
||||
[nginx_client_body_buffer_size]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size
|
||||
[nginx_client_max_body_size]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size
|
||||
[nginx_keepalive_timeout]: http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout
|
||||
[nginx_server_tokens]: http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens
|
||||
[nginx_more_clear_headers]: http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header
|
||||
[nginx_client_header_buffer_size]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_buffer_size
|
||||
[nginx_large_client_header_buffers]: http://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers
|
||||
[nginx_client_body_timeout]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_timeout
|
||||
[nginx_client_header_timeout]: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_timeout
|
||||
[nginx_send_timeout]: http://nginx.org/en/docs/http/ngx_http_core_module.html#send_timeout
|
||||
[nginx_limit_conn_zone]: http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn_zone
|
||||
[nginx_limit_conn]: http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn
|
||||
[nginx_add_header]: http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header
|
||||
[nginx_ssl_protocols]: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols
|
||||
[nginx_ssl_ciphers]: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers
|
||||
[nginx_ssl_prefer_server_ciphers]: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers
|
||||
[nginx_dh_size]: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam
|
||||
@@ -0,0 +1,29 @@
|
||||
---
|
||||
nginx_client_body_buffer_size: '1k'
|
||||
nginx_remove_default_site: true
|
||||
nginx_client_max_body_size: '1k'
|
||||
nginx_keepalive_timeout: '5 5'
|
||||
nginx_server_tokens: 'off'
|
||||
nginx_client_header_buffer_size: "1k"
|
||||
nginx_large_client_header_buffers: "2 1k"
|
||||
nginx_client_body_timeout: "10"
|
||||
nginx_client_header_timeout: "10"
|
||||
nginx_send_timeout: "10"
|
||||
nginx_limit_conn_zone: "$binary_remote_addr zone=default:10m"
|
||||
nginx_limit_conn: "default 5"
|
||||
nginx_add_header: [
|
||||
# vvoid clickjacking
|
||||
"X-Frame-Options SAMEORIGIN",
|
||||
# disable content-type sniffing
|
||||
"X-Content-Type-Options nosniff",
|
||||
# XSS filter
|
||||
"X-XSS-Protection \"1; mode=block\"",
|
||||
"Strict-Transport-Security max-age=15768000",
|
||||
"Content-Security-Policy \"script-src 'self'; object-src 'self'\"" ]
|
||||
|
||||
nginx_set_cookie_flag: "* HttpOnly secure"
|
||||
nginx_ssl_prefer_server_ciphers: "on"
|
||||
nginx_ssl_protocols: "TLSv1.2"
|
||||
nginx_ssl_ciphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"
|
||||
nginx_ssl_session_tickets: "off"
|
||||
nginx_dh_size: "2048"
|
||||
@@ -0,0 +1,5 @@
|
||||
---
|
||||
- name: restart nginx
|
||||
service:
|
||||
name: "nginx"
|
||||
state: restarted
|
||||
@@ -0,0 +1,26 @@
|
||||
---
|
||||
galaxy_info:
|
||||
author: "Sebastian Gumprich"
|
||||
description: 'This Ansible role provides secure nginx configurations. http://dev-sec.io/'
|
||||
company: Hardening Framework Team
|
||||
license: Apache License 2.0
|
||||
min_ansible_version: '2.5'
|
||||
platforms:
|
||||
- name: EL
|
||||
versions:
|
||||
- 6
|
||||
- 7
|
||||
- name: Ubuntu
|
||||
versions:
|
||||
- xenial
|
||||
- bionic
|
||||
- name: Debian
|
||||
versions:
|
||||
- stretch
|
||||
- buster
|
||||
galaxy_tags:
|
||||
- system
|
||||
- security
|
||||
- hardening
|
||||
- nginx
|
||||
dependencies: []
|
||||
@@ -0,0 +1,94 @@
|
||||
---
|
||||
- name: create additional configuration
|
||||
template:
|
||||
src: "hardening.conf.j2"
|
||||
dest: "/etc/nginx/conf.d/90.hardening.conf"
|
||||
mode: '0600'
|
||||
owner: "root"
|
||||
group: "root"
|
||||
notify: restart nginx
|
||||
|
||||
- name: change configuration in main nginx.conf
|
||||
lineinfile:
|
||||
dest: "/etc/nginx/nginx.conf"
|
||||
regexp: '^\s*server_tokens'
|
||||
line: " server_tokens {{ nginx_server_tokens }};"
|
||||
insertafter: "http {"
|
||||
mode: '0640'
|
||||
owner: "root"
|
||||
group: "root"
|
||||
notify: restart nginx
|
||||
|
||||
- name: change ssl_protocols in main nginx.conf
|
||||
lineinfile:
|
||||
dest: "/etc/nginx/nginx.conf"
|
||||
regexp: '^\s*ssl_protocols'
|
||||
line: " ssl_protocols {{ nginx_ssl_protocols }};"
|
||||
insertafter: "http {"
|
||||
mode: '0640'
|
||||
owner: "root"
|
||||
group: "root"
|
||||
notify: restart nginx
|
||||
|
||||
- name: change ssl_prefer_server_ciphers in main nginx.conf
|
||||
lineinfile:
|
||||
dest: "/etc/nginx/nginx.conf"
|
||||
regexp: '^\s*ssl_prefer_server_ciphers'
|
||||
line: " ssl_prefer_server_ciphers {{ nginx_ssl_prefer_server_ciphers }};"
|
||||
insertafter: "http {"
|
||||
mode: '0640'
|
||||
owner: "root"
|
||||
group: "root"
|
||||
notify: restart nginx
|
||||
|
||||
- name: change client_max_body_size in main nginx.conf
|
||||
lineinfile:
|
||||
dest: "/etc/nginx/nginx.conf"
|
||||
regexp: '^\s*client_max_body_size'
|
||||
line: " client_max_body_size {{ nginx_client_max_body_size }};"
|
||||
insertafter: "http {"
|
||||
mode: '0640'
|
||||
owner: "root"
|
||||
group: "root"
|
||||
notify: restart nginx
|
||||
|
||||
- name: change client_body_buffer_size in main nginx.conf
|
||||
lineinfile:
|
||||
dest: "/etc/nginx/nginx.conf"
|
||||
regexp: '^\s*client_body_buffer_size'
|
||||
line: " client_body_buffer_size {{ nginx_client_body_buffer_size }};"
|
||||
insertafter: "http {"
|
||||
mode: '0640'
|
||||
owner: "root"
|
||||
group: "root"
|
||||
notify: restart nginx
|
||||
|
||||
- name: change keepalive_timeout in main nginx.conf
|
||||
lineinfile:
|
||||
dest: "/etc/nginx/nginx.conf"
|
||||
regexp: '^\s*keepalive_timeout'
|
||||
line: " keepalive_timeout {{ nginx_keepalive_timeout }};"
|
||||
insertafter: "http {"
|
||||
mode: '0640'
|
||||
owner: "root"
|
||||
group: "root"
|
||||
notify: restart nginx
|
||||
|
||||
- name: remove default.conf
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
state: absent
|
||||
when: nginx_remove_default_site
|
||||
notify: restart nginx
|
||||
loop:
|
||||
- "/etc/nginx/conf.d/default.conf"
|
||||
- "/etc/nginx/sites-enabled/default"
|
||||
|
||||
- name: generate dh group
|
||||
openssl_dhparam:
|
||||
path: "/etc/nginx/dh{{ nginx_dh_size }}.pem"
|
||||
size: "{{ nginx_dh_size }}"
|
||||
mode: '0640'
|
||||
owner: "root"
|
||||
group: "root"
|
||||
notify: restart nginx
|
||||
@@ -0,0 +1,16 @@
|
||||
# {{ ansible_managed|comment }}
|
||||
# Additional configuration for Nginx.
|
||||
|
||||
client_header_buffer_size {{ nginx_client_header_buffer_size }};
|
||||
large_client_header_buffers {{ nginx_large_client_header_buffers }};
|
||||
client_body_timeout {{ nginx_client_body_timeout }};
|
||||
client_header_timeout {{ nginx_client_header_timeout }};
|
||||
send_timeout {{ nginx_send_timeout }};
|
||||
limit_conn_zone {{ nginx_limit_conn_zone }};
|
||||
limit_conn {{ nginx_limit_conn }};
|
||||
ssl_ciphers '{{ nginx_ssl_ciphers }}';
|
||||
ssl_session_tickets {{ nginx_ssl_session_tickets }};
|
||||
ssl_dhparam /etc/nginx/dh{{ nginx_dh_size }}.pem;
|
||||
{% for header in nginx_add_header %}
|
||||
add_header {{ header }};
|
||||
{% endfor %}
|
||||
@@ -0,0 +1 @@
|
||||
---
|
||||
Reference in new issue
Block a user