ansible_cis_nginx_hardening
Ansible CIS Nginx Hardening (still under Testing Phase)
Based on CIS NGINX Benchmark v1.0.0 - 02-28-2019
Nginx is arguably one of the most widely used free and opensource web server used in hosting high-traffic websites. It is well known for its stability, stellar-performance, low resource consumption, and lean configuration. The default configurations are not secure and extra tweaks are required to fortify the web server and give it the much-needed security to prevent attacks and breaches, So this role establish secure configuration posture for NGINX running on Ubuntu
Scoring Information
- A scoring status indicates whether compliance with the given recommendation impacts the assessed target's benchmark score. The following scoring statuses are used in this benchmark:
Scored (implemented in this role)
- Failure to comply with "Scored" recommendations will decrease the final benchmark score. Compliance with "Scored" recommendations will increase the final benchmark score.
Not Scored (not implements in this role)
- Failure to comply with "Not Scored" recommendations will not decrease the final benchmark score. Compliance with "Not Scored" recommendations will not increase the final benchmark score.
The main benefits of using NGINX packages from your vendor are:
- Ease of installation
- Dependency resolution
- Increased effectiveness of maintenance and security patches
- Q&A procedures carried out by your vendor
Requirements
Since this role will install the latest Nginx package from the OS repository, make sure to run this role in fresh nginx server, this will handle the installation process.
It may work if you already install nginx in your server.
Role Variables
config as following
large_client_header_buffers: "2 1k"
client_max_body_size: "100K"
client_body_timeout: 10
client_header_timeout: 10
strict_transport_security_max_age: 15768000 #max-age directive with 15768000 seconds (six months) or longer
nginx_site_config_dir: /etc/nginx/sites-available/
#Or ALL:!EXP:!NULL:!ADH:!LOW:!SSLv2:!SSLv3:!MD5:!RC4;
ssl_ciphers: ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
nginx_key: /etc/ssl/private/nginx-selfsigned.key
nginx_cert: /etc/ssl/certs/nginx-selfsigned.crt
backendserver: http://localhost:3000
backendserver_ssl: True
access_log: /var/log/nginx/alivx.com.access.log
error_log: /var/log/nginx/alivx.com.error.log warn
domainName: 172.16.186.129
Dependencies
Example Playbook
Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
---
- hosts: host1
become: yes
remote_user: root
gather_facts: no
roles:
- { role: "ansible-cis-nginx-hardening" }
Benchmarks
- 1 Initial Setup
- 1.1 Installation
- 1.1.1 Ensure NGINX is installed (Scored)
- 1.2 Configure Software Updates
- 2 Basic Configuration
- 2.1 Minimize NGINX Modules
- 2.1.2 Ensure HTTP WebDAV module is not installed (Scored)
- 2.1.3 Ensure modules with gzip functionality is disabled (Scored)
- 2.1.4 Ensure the autoindex module is disabled (Scored)
- 2.2 Account Security
- 2.2.2 Ensure the NGINX service account is locked (Scored)
- 2.2.3 Ensure the NGINX service account has an invalid shell (Scored)
- 2.3 Permissions and Ownership
- 2.3.1 Ensure NGINX directories and files are owned by root (Scored)
- 2.3.2 Ensure access to NGINX directories and files is restricted (Scored)
- 2.3.3 Ensure the NGINX process ID (PID) file is secured (Scored)
- 2.4 Network Configuration
- 2.4.1 Ensure NGINX only listens for network connections on authorized ports (NotScored)
- 2.4.3 Ensure keepalive_timeout is 10 seconds or less, but not 0 (Scored)
- 2.4.4 Ensure send_timeout is set to 10 seconds or less, but not 0 (Scored)
- 2.5 Information Disclosure
- 2.5.1 Ensure server_tokens directive is set to
off
(Scored) - 2.5.2 Ensure default error and index.html pages do not reference NGINX (Scored)
- 2.5.4 Ensure the NGINX reverse proxy does not enable information disclosure (Scored)
- 3 Logging
- 3.2 Ensure access logging is enabled (Scored)
- 3.3 Ensure error logging is enabled and set to the info logging level (Scored)
- 3.4 Ensure log files are rotated (Scored)
- 3.7 Ensure proxies pass source IP information (Scored)
- 4 Encryption
- 4.1 TLS / SSL Configuration
- 4.1.1 Ensure HTTP is redirected to HTTPS (Scored)
- 4.1.3 Ensure private key permissions are restricted (Scored)
- 4.1.4 Ensure only modern TLS protocols are used (Scored)
- 4.1.5 Disable weak ciphers (Scored)
- 4.1.6 Ensure custom Diffie-Hellman parameters are used (Scored)
- 4.1.7 Ensure Online Certificate Status Protocol (OCSP) stapling is enabled (Scored)
- 4.1.8 Ensure HTTP Strict Transport Security (HSTS) is enabled (Scored)
- 4.1.10 Ensure upstream server traffic is authenticated with a client certificate (Scored)
- 4.1.13 Ensure session resumption is disabled to enable perfect forward security (Scored)
- 5 Request Filtering and Restrictions
- 5.1 Access Control
- 5.2 Request Limits
- 5.2.1 Ensure timeout values for reading the client header and body are set correctly (Scored)
- 5.2.2 Ensure the maximum request body size is set correctly (Scored)
- 5.2.3 Ensure the maximum buffer size for URIs is defined (Scored)
- 5.3 Browser Security
- 5.3.1 Ensure X-Frame-Options header is configured and enabled (Scored)
- 5.3.2 Ensure X-Content-Type-Options header is configured and enabled (Scored)
- 5.3.3 Ensure the X-XSS-Protection Header is enabled and configured properly (Scored)
License
GNU GENERAL PUBLIC LICENSE
Author Information
The role was originally developed by Ali Saleh Baker.
When contributing to this repository, please first discuss the change you wish to make via a GitHub issue, email, or via other channels with me :)