nginx安全加固,设置缓冲区，防止溢出

nginx安全加固,设置缓冲区，防止溢出

nginx安全

• 安装启服务

[root@node1 lnmp_soft]# yum install -y gcc pcre-devel zlib-devel
[root@node1 lnmp_soft]# tar xf nginx-1.12.2.tar.gz 
[root@node1 lnmp_soft]# cd nginx-1.17.2/
[root@node1 nginx-1.12.2]# ./configure && make && make install
[root@node1 ~]# /usr/local/nginx/sbin/nginx 

• 

• 命令行访问：

[root@node1 ~]# curl -I http://192.168.4.11/    # -I 只显示头部
HTTP/1.1 200 OK
Server: nginx/1.12.2
Date: Fri, 10 Dec 2021 07:51:08 GMT
Content-Type: text/html
Content-Length: 612
Last-Modified: Fri, 10 Dec 2021 07:46:16 GMT
Connection: keep-alive
ETag: "61b305c8-264"
Accept-Ranges: bytes

• 隐藏版本信息

[root@node1 ~]# vim /usr/local/nginx/conf/nginx.conf
... ...
 17 http {
 18     server_tokens off;
... ...
[root@node1 ~]# /usr/local/nginx/sbin/nginx -s reload

再次访问不存在的路径，版本号消失

• 防止DOS、DDOS攻击
• DDOS：分布式拒绝服务

# 压力测试，每批次发送100个请求给web服务器，一共发200个
[root@zzgrhel8 ~]# yum install -y httpd-tools
[root@zzgrhel8 ~]# ab -c 100 -n 200 http://192.168.4.11/ 
... ...
Benchmarking 192.168.4.11 (be patient)
Completed 100 requests
Completed 200 requests
Finished 200 requests    # 发送200个请求完成
... ... 
Complete requests:      200   # 完成了200个请求
Failed requests:        0     # 0个失败
... ...

• 配置nginx连接共享内存为10M，每秒钟只接收一个请求，最多有5个请求排队，多余的拒绝

[root@node1 ~]# vim /usr/local/nginx/conf/nginx.conf
 17 http {
 18     limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;   # 添加
... ...
 37     server {
 38         listen       80;
 39         server_name  localhost;
 40         limit_req zone=one burst=5;  # 添加
[root@node1 ~]# /usr/local/nginx/sbin/nginx -s reload

# 再次测试
[root@zzgrhel8 ~]# ab -c 100 -n 200 http://192.168.4.11/ 
... ...
Benchmarking 192.168.4.11 (be patient)
Completed 100 requests
Completed 200 requests
Finished 200 requests
... ...
Complete requests:      200
Failed requests:        194   # 失败了194个
... ...

防止缓冲区溢出

• 缓冲区溢出定义：程序企图在预分配的缓冲区之外写数据。
• 漏洞危害：用于更改程序执行流，控制函数返回值，执行任意代码。

# 配置nginx缓冲区大小，防止缓冲区溢出
[root@node1 ~]# vim /usr/local/nginx/conf/nginx.conf
... ...
 17 http {
 18     client_body_buffer_size     1k;
 19     client_header_buffer_size   1k;
 20     client_max_body_size        1k;
 21     large_client_header_buffers 2 1k;
... ...
[root@node1 ~]# /usr/local/nginx/sbin/nginx -s reload

1 large_client_header_buffers 2 1k;
… …
[root@node1 ~]# /usr/local/nginx/sbin/nginx -s reload