Bunkerized-Nginx - Nginx Docker Image Secure By Default

Bunkerized-Nginx - Nginx Docker Image Secure By Default
2020-11-26 20:30:00 Author: www.blogger.com(查看原文) 阅读量:199 收藏

tag:blogger.com,1999:blog-8317222231133660547.post-10721370380891314352020-11-26T08:30:00.012-03:002020-11-26T08:30:03.492-03:00Bunkerized-Nginx - Nginx Docker Image Secure By Default<div class="separator" style="clear: both; text-align: center;"><a href="https://1.bp.blogspot.com/-_dNj-zGfDHk/X78n1Cm44uI/AAAAAAAAUeU/p01vT0T8LacScDWE6GMQZEmVdNoJ1zk-gCNcBGAsYHQ/s594/bunkerized-nginx_1_logo.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="594" data-original-width="578" height="400" src="https://1.bp.blogspot.com/-_dNj-zGfDHk/X78n1Cm44uI/AAAAAAAAUeU/p01vT0T8LacScDWE6GMQZEmVdNoJ1zk-gCNcBGAsYHQ/w389-h400/bunkerized-nginx_1_logo.png" width="389" /></a></div> nginx Docker image secure by default. Avoid the hassle of following security best practices each time you need a web server or reverse proxy. Bunkerized-nginx provides generic security configs, settings and tools so you don't need to do it yourself.<a name='more'></a> Non-exhaustive list of features : <ul> <li>HTTPS support with transparent Let's Encrypt automation</li> <li>State-of-the-art web security : HTTP security headers, prevent leaks, TLS hardening, ...</li> <li>Integrated <a href="https://www.kitploit.com/search/label/ModSecurity" target="_blank" title="ModSecurity">ModSecurity</a> WAF with the OWASP Core Rule Set</li> <li>Automatic ban of strange behaviors with fail2ban</li> <li>Antibot challenge through cookie, javascript, captcha or recaptcha v3</li> <li>Block TOR, proxies, bad user-agents, countries, ...</li> <li>Block known bad IP with DNSBL and CrowdSec</li> <li>Prevent <a href="https://www.kitploit.com/search/label/Bruteforce%20Attacks" target="_blank" title="bruteforce attacks">bruteforce attacks</a> with rate limiting</li> <li>Detect bad files with ClamAV</li> <li>Easy to configure with environment variables</li> </ul> Fooling automated tools/scanners : <div class="separator" style="clear: both; text-align: center;"><a href="https://1.bp.blogspot.com/-kSXvDtAb2kM/X78oCWOs3iI/AAAAAAAAUeY/GwFIqhKAMCAd1q6AvQ6BdUNKIcdwOLiJwCNcBGAsYHQ/s694/bunkerized-nginx_7_demo.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="604" data-original-width="694" height="558" src="https://1.bp.blogspot.com/-kSXvDtAb2kM/X78oCWOs3iI/AAAAAAAAUeY/GwFIqhKAMCAd1q6AvQ6BdUNKIcdwOLiJwCNcBGAsYHQ/w640-h558/bunkerized-nginx_7_demo.gif" width="640" /></a></div> Live demo You can find a live demo at <a href="https://demo-nginx.bunkerity.com" rel="nofollow" target="_blank" title="https://demo-nginx.bunkerity.com">https://demo-nginx.bunkerity.com</a>. Quickstart guide Run HTTP server with default settings <div><pre><code>docker run -p 80:8080 -v /path/to/web/files:/www:ro bunkerity/bunkerized-nginx</code></pre></div> Web files are stored in the /www directory, the container will serve files from there. In combination with PHP <div><pre><code>docker network create mynet docker run --network mynet \ -p 80:8080 \ -v /path/to/web/files:/www:ro \ -e REMOTE_PHP=myphp \ -e REMOTE_PHP_PATH=/app \ bunkerity/bunkerized-nginx docker run --network mynet \ --name=myphp \ -v /path/to/web/files:/app \ php:fpm</code></pre></div> The <code>REMOTE_PHP</code> environment variable lets you define the address of a remote PHP-FPM instance that will execute the .php files. <code>REMOTE_PHP_PATH</code> must be set to the directory where the PHP container will find the files. Run HTTPS server with automated Let's Encrypt <div><pre><code>docker run -p 80:8080 \ -p 443:8443 \ -v /path/to/web/files:/www:ro \ -v /where/to/save/certificates:/etc/letsencrypt \ -e SERVER_NAME=www.yourdomain.com \ -e AUTO_LETS_ENCRYPT=yes \ -e REDIRECT_HTTP_TO_HTTPS=yes \ bunkerity/bunkerized-nginx</code></pre></div> Certificates are stored in the /etc/letsencrypt directory, you should save it on your local drive. If you don't want your webserver to listen on HTTP add the environment variable <code>LISTEN_HTTP</code> with a no value. But Let's Encrypt needs the port 80 to be opened so redirecting the port is mandatory. Here you have three environment variables : <ul> <li><code>SERVER_NAME</code> : define the FQDN of your webserver, this is mandatory for Let's Encrypt (<a href="http://www.yourdomain.com" rel="nofollow" target="_blank" title="www.yourdomain.com">www.yourdomain.com</a> should point to your IP address)</li> <li><code>AUTO_LETS_ENCRYPT</code> : enable automatic Let's Encrypt creation and renewal of certificates</li> <li><code>REDIRECT_HTTP_TO_HTTPS</code> : enable HTTP to HTTPS redirection</li> </ul> As a reverse proxy <div><pre><code>docker run -p 80:8080 \ -e USE_REVERSE_PROXY=yes \ -e REVERSE_PROXY_URL=/ \ -e REVERSE_PROXY_HOST=http://myserver:8080 \ bunkerity/bunkerized-nginx</code></pre></div> This is a simple reverse proxy to a unique application. If you have more than one application you can add more REVERSE_PROXY_URL/REVERSE_PROXY_HOST by appending a suffix number like this : <div><pre><code>docker run -p 80:8080 \ -e USE_REVERSE_PROXY=yes \ -e REVERSE_PROXY_URL_1=/app1/ \ -e REVERSE_PROXY_HOST_1=http://myapp1:3000/ \ -e REVERSE_PROXY_URL_2=/app2/ \ -e REVERSE_PROXY_HOST_2=http://myapp2:3000/ \ bunkerity/bunkerized-nginx</code></pre></div> Behind a reverse proxy <div><pre><code>docker run -p 80:8080 \ -v /path/to/web/files:/www \ -e PROXY_REAL_IP=yes \ bunkerity/bunkerized-nginx</code></pre></div> The <code>PROXY_REAL_IP</code> environment variable, when set to yes, activates the <a href="https://nginx.org/en/docs/http/ngx_http_realip_module.html" rel="nofollow" target="_blank" title="ngx_http_realip_module">ngx_http_realip_module</a> to get the real client IP from the reverse proxy. See <a href="https://github.com/bunkerity/bunkerized-nginx#reverse-proxy" rel="nofollow" target="_blank" title="this section">this section</a> if you need to tweak some values (trusted ip/network, header, ...). Multisite By default, bunkerized-nginx will only create one server block. When setting the <code>MULTISITE</code> environment variable to yes, one server block will be created for each host defined in the <code>SERVER_NAME</code> environment variable. You can set/override values for a specific server by prefixing the environment variable with one of the server name previously defined. <div><pre><code>docker run -p 80:8080 \ -p 443:8443 \ -v /where/to/save/certificates:/etc/letsencrypt \ -e SERVER_NAME=app1.domain.com app2.domain.com \ -e MULTISITE=yes \ -e AUTO_LETS_ENCRYPT=yes \ -e REDIRECT_HTTP_TO_HTTPS=yes \ -e USE_REVERSE_PROXY=yes \ -e app1.domain.com_PROXY_URL=/ \ -e app1.domain.com_PROXY_HOST=http://myapp1:8000 \ -e app2.domain.com_PROXY_URL=/ \ -e app2.domain.com_PROXY_HOST=http://myapp2:8000 \ bunkerity/bunkerized-nginx</code></pre></div> The <code>USE_REVERSE_PROXY</code> is a global variable that will be applied to each server block. Whereas the <code>app1.domain.com_*</code> and <code>app2.domain.com_*</code> will only be applied to the app1.domain.com and app2.domain.com server block respectively. When serving files, the web root directory should contains subdirectories named as the servers defined in the <code>SERVER_NAME</code> environment variable. Here is an example : <div><pre><code>docker run -p 80:8080 \ -p 443:8443 \ -v /where/to/save/certificates:/etc/letsencrypt \ -v /where/are/web/files:/www:ro \ -e SERVER_NAME=app1.domain.com app2.domain.com \ -e MULTISITE=yes \ -e AUTO_LETS_ENCRYPT=yes \ -e REDIRECT_HTTP_TO_HTTPS=yes \ -e app1.domain.com_REMOTE_PHP=php1 \ -e app1.domain.com_REMOTE_PHP_PATH=/app \ -e app2.domain.com_REMOTE_PHP=php2 \ -e app2.domain.com_REMOTE_PHP_PATH=/app \ bunkerity/bunkerized-nginx</code></pre></div> The /where/are/web/files directory should have a structure like this : <div><pre><code>/where/are/web/files ├── app1.domain.com │   └── index.php │   └── ... └── app2.domain.com └── index.php └── ...</code></pre></div> Antibot challenge <div><pre><code>docker run -p 80:8080 -v /path/to/web/files:/www -e USE_ANTIBOT=captcha bunkerity/bunkerized-nginx</code></pre></div> When <code>USE_ANTIBOT</code> is set to captcha, every users visiting your website must complete a captcha before accessing the pages. Others challenges are also available : cookie, javascript or recaptcha (more info <a href="https://github.com/bunkerity/bunkerized-nginx#antibot" rel="nofollow" target="_blank" title="here">here</a>). Tutorials and examples You will find some docker-compose.yml examples in the <a href="https://github.com/bunkerity/bunkerized-nginx/tree/master/examples" rel="nofollow" target="_blank" title="examples directory">examples directory</a> and tutorials about bunkerized-nginx in our <a href="https://www.bunkerity.com/category/bunkerized-nginx/" rel="nofollow" target="_blank" title="blog">blog</a>. List of environment variables nginx Misc <code>MULTISITE</code> Values : yes | no Default value : no Context : global When set to no, only one server block will be generated. Otherwise one server per host defined in the <code>SERVER_NAME</code> environment variable will be generated. Any environment variable tagged as multisite context can be used for a specific server block with the following format : host_VARIABLE=value. If the variable is used without the host prefix it will be applied to all the server blocks (but still can be overriden). <code>SERVER_NAME</code> Values : <first name> <second name> ... Default value : <a href="http://www.bunkerity.com" rel="nofollow" target="_blank" title="www.bunkerity.com">www.bunkerity.com</a> Context : global Sets the host names of the webserver separated with spaces. This must match the Host header sent by clients. Useful when used with <code>MULTISITE=yes</code> and/or <code>AUTO_LETSENCRYPT=yes</code> and/or <code>DISABLE_DEFAULT_SERVER=yes</code>. <code>MAX_CLIENT_SIZE</code> Values : 0 | Xm Default value : 10m Context : global, multisite Sets the maximum body size before nginx returns a 413 error code. Setting to 0 means "infinite" body size. <code>ALLOWED_METHODS</code> Values : allowed HTTP methods separated with | char Default value : GET|POST|HEAD Context : global, multisite Only the HTTP methods listed here will be accepted by nginx. If not listed, nginx will close the connection. <code>DISABLE_DEFAULT_SERVER</code> Values : yes | no Default value : no Context : global, multisite If set to yes, nginx will only respond to HTTP request when the Host header match a FQDN specified in the <code>SERVER_NAME</code> environment variable. For example, it will close the connection if a bot access the site with direct ip. <code>SERVE_FILES</code> Values : yes | no Default value : yes Context : global, multisite If set to yes, nginx will serve files from /www directory within the container. A use case to not serving files is when you setup bunkerized-nginx as a reverse proxy via a custom configuration. <code>DNS_RESOLVERS</code> Values : <two IP addresses separated with a space> Default value : 127.0.0.11 8.8.8.8 Context : global The IP addresses of the DNS resolvers to use when performing DNS lookups. <code>ROOT_FOLDER</code> Values : *<any valid path to web files> Default value : /www Context : global The default folder where nginx will search for web files. Don't change it unless you want to make your own image. <code>HTTP_PORT</code> Values : <any valid port greater than 1024> Default value : 8080 Context : global The HTTP port number used by nginx and certbot inside the container. <code>HTTPS_PORT</code> Values : <any valid port greater than 1024> Default value : 8443 Context : global The HTTPS port number used by nginx inside the container. Information leak <code>SERVER_TOKENS</code> Values : on | off Default value : off Context : global If set to on, nginx will display server version in Server header and default error pages. <code>REMOVE_HEADERS</code> Values : <list of headers separated with space> Default value : Server X-Powered-By X-AspNet-Version X-AspNetMvc-Version Context : global, multisite List of header to remove when sending responses to clients. Custom error pages <code>ERROR_XXX</code> Values : <relative path to the error page> Default value : Context : global, multisite Use this kind of environment variable to define custom error page depending on the HTTP error code. Replace XXX with HTTP code. For example : <code>ERROR_404=/404.html</code> means the /404.html page will be displayed when 404 code is generated. The path is relative to the root web folder. HTTP basic authentication <code>USE_AUTH_BASIC</code> Values : yes | no Default value : no Context : global, multisite If set to yes, enables HTTP <a href="https://www.kitploit.com/search/label/Basic%20Authentication" target="_blank" title="basic authentication">basic authentication</a> at the location <code>AUTH_BASIC_LOCATION</code> with user <code>AUTH_BASIC_USER</code> and password <code>AUTH_BASIC_PASSWORD</code>. <code>AUTH_BASIC_LOCATION</code> Values : sitewide | /somedir | <any valid location> Default value : sitewide Context : global, multisite The location to restrict when <code>USE_AUTH_BASIC</code> is set to yes. If the special value sitewide is used then auth basic will be set at server level outside any location context. <code>AUTH_BASIC_USER</code> Values : <any valid username> Default value : changeme Context : global, multisite The username allowed to access <code>AUTH_BASIC_LOCATION</code> when <code>USE_AUTH_BASIC</code> is set to yes. <code>AUTH_BASIC_PASSWORD</code> Values : <any valid password> Default value : changeme Context : global, multisite The password of <code>AUTH_BASIC_USER</code> when <code>USE_AUTH_BASIC</code> is set to yes. <code>AUTH_BASIC_TEXT</code> Values : <any valid text> Default value : Restricted area Context : global, multisite The text displayed inside the login prompt when <code>USE_AUTH_BASIC</code> is set to yes. Reverse proxy <code>USE_REVERSE_PROXY</code> Values : yes | no Default value : no Context : global, multisite Set this environment variable to yes if you want to use bunkerized-nginx as a reverse proxy. <code>REVERSE_PROXY_URL</code> Values : <any valid location path> Default value : Context : global, multisite Only valid when <code>USE_REVERSE_PROXY</code> is set to yes. Let's you define the location path to match when acting as a reverse proxy. You can set multiple url/host by adding a suffix number to the variable name like this : <code>REVERSE_PROXY_URL_1</code>, <code>REVERSE_PROXY_URL_2</code>, <code>REVERSE_PROXY_URL_3</code>, ... <code>REVERSE_PROXY_HOST</code> Values : <any valid proxy_pass value> Default value : Context : global, multisite Only valid when <code>USE_REVERSE_PROXY</code> is set to yes. Let's you define the proxy_pass destination to use when acting as a reverse proxy. You can set multiple url/host by adding a suffix number to the variable name like this : <code>REVERSE_PROXY_HOST_1</code>, <code>REVERSE_PROXY_HOST_2</code>, <code>REVERSE_PROXY_HOST_3</code>, ... <code>PROXY_REAL_IP</code> Values : yes | no Default value : no Context : global, multisite Set this environment variable to yes if you're using bunkerized-nginx behind a reverse proxy. This means you will see the real client address instead of the proxy one inside your logs. Modsecurity, fail2ban and others security tools will also then work correctly. <code>PROXY_REAL_IP_FROM</code> Values : <list of trusted IP addresses and/or networks separated with spaces> Default value : 192.168.0.0/16 172.16.0.0/12 10.0.0.0/8 Context : global, multisite When <code>PROXY_REAL_IP</code> is set to yes, lets you define the trusted IPs/networks allowed to send the correct client address. <code>PROXY_REAL_IP_HEADER</code> Values : X-Forwarded-For | X-Real-IP | custom header Default value : X-Forwarded-For Context : global, multisite When <code>PROXY_REAL_IP</code> is set to yes, lets you define the header that contains the real client IP address. <code>PROXY_REAL_IP_RECURSIVE</code> Values : on | off Default value : on Context : global, multisite When <code>PROXY_REAL_IP</code> is set to yes, setting this to on avoid spoofing attacks using the header defined in <code>PROXY_REAL_IP_HEADER</code>. Compression <code>USE_GZIP</code> Values : yes | no Default value : no Context : global, multisite When set to yes, nginx will use the gzip algorithm to compress responses sent to clients. <code>GZIP_COMP_LEVEL</code> Values : <any integer between 1 and 9> Default value : 5 Context : global, multisite The gzip compression level to use when <code>USE_GZIP</code> is set to yes. <code>GZIP_MIN_LENGTH</code> Values : <any positive integer> Default value : 1000 Context : global, multisite The minimum size (in bytes) of a response required to compress when <code>USE_GZIP</code> is set to yes. <code>GZIP_TYPES</code> Values : <list of mime types separated with space> Default value : application/atom+xml application/javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-opentype application/x-font-truetype application/x-font-ttf application/x-javascript application/xhtml+xml application/xml font/eot font/opentype font/otf font/truetype image/svg+xml image/vnd.microsoft.icon image/x-icon image/x-win-bitmap text/css text/javascript text/plain text/xml Context : global, multisite List of response MIME type required to compress when <code>USE_GZIP</code> is set to yes. <code>USE_BROTLI</code> Values : yes | no Default value : no Context : global, multisite When set to yes, nginx will use the brotli algorithm to compress responses sent to clients. <code>BROTLI_COMP_LEVEL</code> Values : <any integer between 1 and 9> Default value : 5 Context : global, multisite The brotli compression level to use when <code>USE_BROTLI</code> is set to yes. <code>BROTLI_MIN_LENGTH</code> Values : <any positive integer> Default value : 1000 Context : global, multisite The minimum size (in bytes) of a response required to compress when <code>USE_BROTLI</code> is set to yes. <code>BROTLI_TYPES</code> Values : <list of mime types separated with space> Default value : application/atom+xml application/javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-opentype application/x-font-truetype application/x-font-ttf application/x-javascript application/xhtml+xml application/xml font/eot font/opentype font/otf font/truetype image/svg+xml image/vnd.microsoft.icon image/x-icon image/x-win-bitmap text/css text/javascript text/plain text/xml Context : global, multisite List of response MIME type required to compress when <code>USE_BROTLI</code> is set to yes. Cache <code>USE_CLIENT_CACHE</code> Values : yes | no Default value : no Context : global, multisite When set to yes, clients will be told to cache some files locally. <code>CLIENT_CACHE_EXTENSIONS</code> Values : <list of extensions separated with |> Default value : jpg|jpeg|png|bmp|ico|svg|tif|css|js|otf|ttf|eot|woff|woff2 Context : global, multisite List of file extensions that clients should cache when <code>USE_CLIENT_CACHE</code> is set to yes. <code>CLIENT_CACHE_CONTROL</code> Values : <Cache-Control header value> Default value : public, max-age=15552000 Context : global, multisite Content of the <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control" rel="nofollow" target="_blank" title="Cache-Control">Cache-Control</a> header to send when <code>USE_CLIENT_CACHE</code> is set to yes. <code>CLIENT_CACHE_ETAG</code> Values : on | off Default value : on Context : global, multisite Whether or not nginx will send the <a href="https://en.wikipedia.org/wiki/HTTP_ETag" rel="nofollow" target="_blank" title="ETag">ETag</a> header when <code>USE_CLIENT_CACHE</code> is set to yes. <code>USE_OPEN_FILE_CACHE</code> Values : yes | no Default value : no Context : global, multisite When set to yes, nginx will cache open fd, existence of directories, ... See <a href="http://nginx.org/en/docs/http/ngx_http_core_module.html#open_file_cache" rel="nofollow" target="_blank" title="open_file_cache">open_file_cache</a>. <code>OPEN_FILE_CACHE</code> Values : <any valid open_file_cache parameters> Default value : max=1000 inactive=20s Context : global, multisite Parameters to use with open_file_cache when <code>USE_OPEN_FILE_CACHE</code> is set to yes. <code>OPEN_FILE_CACHE_ERRORS</code> Values : on | off Default value : on Context : global, multisite Whether or not nginx should cache file lookup errors when <code>USE_OPEN_FILE_CACHE</code> is set to yes. <code>OPEN_FILE_CACHE_MIN_USES</code> Values : <*any valid integer *> Default value : 2 Context : global, multisite The minimum number of file accesses required to cache the fd when <code>USE_OPEN_FILE_CACHE</code> is set to yes. <code>OPEN_FILE_CACHE_VALID</code> Values : <any time value like Xs, Xm, Xh, ...> Default value : 30s Context : global, multisite The time after which cached elements should be validated when <code>USE_OPEN_FILE_CACHE</code> is set to yes. <code>USE_PROXY_CACHE</code> Values : yes | no Default value : no Context : global, multisite When set to yes, nginx will cache responses from proxied applications. See <a href="http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cache" rel="nofollow" target="_blank" title="proxy_cache">proxy_cache</a>. <code>PROXY_CACHE_PATH_ZONE_SIZE</code> Values : <any valid size like Xk, Xm, Xg, ...> Default value : 10m Context : global, multisite Maximum size of cached metadata when <code>USE_PROXY_CACHE</code> is set to yes. <code>PROXY_CACHE_PATH_PARAMS</code> Values : <any valid parameters to proxy_cache_path directive> Default value : max_size=100m Context : global, multisite Parameters to use for <a href="http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cache_path" rel="nofollow" target="_blank" title="proxy_cache_path">proxy_cache_path</a> directive when <code>USE_PROXY_CACHE</code> is set to yes. <code>PROXY_CACHE_METHODS</code> Values : <list of HTTP methods separated with space> Default value : GET HEAD Context : global, multisite The HTTP methods that should trigger a cache operation when <code>USE_PROXY_CACHE</code> is set to yes. <code>PROXY_CACHE_MIN_USES</code> Values : <any positive integer> Default value : 2 Context : global, multisite The minimum number of requests before the response is cached when <code>USE_PROXY_CACHE</code> is set to yes. <code>PROXY_CACHE_KEY</code> Values : <list of variables> Default value : $scheme$host$request_uri Context : global, multisite The key used to uniquely identify a cached response when <code>USE_PROXY_CACHE</code> is set to yes. <code>PROXY_CACHE_VALID</code> Values : <status=time list separated with space> Default value : 200=10m 301=10m 301=1h any=1m Context : global, multisite Define the caching time depending on the HTTP status code (list of status=time separated with space) when <code>USE_PROXY_CACHE</code> is set to yes. <code>PROXY_NO_CACHE</code> Values : <list of variables> Default value : $http_authorization Context : global, multisite Conditions that must be met to disable caching of the response when <code>USE_PROXY_CACHE</code> is set to yes. <code>PROXY_CACHE_BYPASS</code> Values : <list of variables> Default value : $http_authorization Context : global, multisite Conditions that must be met to bypass the cache when <code>USE_PROXY_CACHE</code> is set to yes. HTTPS Let's Encrypt <code>AUTO_LETS_ENCRYPT</code> Values : yes | no Default value : no Context : global If set to yes, automatic certificate generation and renewal will be setup through Let's Encrypt. This will enable HTTPS on your website for free. You will need to redirect the 80 port to 8080 port inside container and also set the <code>SERVER_NAME</code> environment variable. HTTP <code>LISTEN_HTTP</code> Values : yes | no Default value : yes Context : global, multisite If set to no, nginx will not in listen on HTTP (port 80). Useful if you only want HTTPS access to your website. <code>REDIRECT_HTTP_TO_HTTPS</code> Values : yes | no Default value : no Context : global, multisite If set to yes, nginx will redirect all HTTP requests to HTTPS. Custom certificate <code>USE_CUSTOM_HTTPS</code> Values : yes | no Default value : no Context : global If set to yes, HTTPS will be enabled with certificate/key of your choice. <code>CUSTOM_HTTPS_CERT</code> Values : <any valid path inside the container> Default value : Context : global Full path of the certificate file to use when <code>USE_CUSTOM_HTTPS</code> is set to yes. <code>CUSTOM_HTTPS_KEY</code> Values : <any valid path inside the container> Default value : Context : global Full path of the key file to use when <code>USE_CUSTOM_HTTPS</code> is set to yes. Self-signed certificate <code>GENERATE_SELF_SIGNED_SSL</code> Values : yes | no Default value : no Context : global If set to yes, HTTPS will be enabled with a container generated self-signed certificate. <code>SELF_SIGNED_SSL_EXPIRY</code> Values : integer Default value : 365 (1 year) Context : global Needs <code>GENERATE_SELF_SIGNED_SSL</code> to work. Sets the expiry date for the self generated certificate. <code>SELF_SIGNED_SSL_COUNTRY</code> Values : text Default value : Switzerland Context : global Needs <code>GENERATE_SELF_SIGNED_SSL</code> to work. Sets the country for the self generated certificate. <code>SELF_SIGNED_SSL_STATE</code> Values : text Default value : Switzerland Context : global Needs <code>GENERATE_SELF_SIGNED_SSL</code> to work. Sets the state for the self generated certificate. <code>SELF_SIGNED_SSL_CITY</code> Values : text Default value : Bern Context : global Needs <code>GENERATE_SELF_SIGNED_SSL</code> to work. Sets the city for the self generated certificate. <code>SELF_SIGNED_SSL_ORG</code> Values : text Default value : AcmeInc Context : global Needs <code>GENERATE_SELF_SIGNED_SSL</code> to work. Sets the organisation name for the self generated certificate. <code>SELF_SIGNED_SSL_OU</code> Values : text Default value : IT Context : global Needs <code>GENERATE_SELF_SIGNED_SSL</code> to work. Sets the organisitional unit for the self generated certificate. <code>SELF_SIGNED_SSL_CN</code> Values : text Default value : bunkerity-nginx Context : global Needs <code>GENERATE_SELF_SIGNED_SSL</code> to work. Sets the CN server name for the self generated certificate. Misc <code>HTTP2</code> Values : yes | no Default value : yes Context : global, multisite If set to yes, nginx will use HTTP2 protocol when HTTPS is enabled. <code>HTTPS_PROTOCOLS</code> Values : TLSv1.2 | TLSv1.3 | TLSv1.2 TLSv1.3 Default value : TLSv1.2 TLSv1.3 Context : global, multisite The supported version of TLS. We recommend the default value TLSv1.2 TLSv1.3 for compatibility reasons. ModSecurity <code>USE_MODSECURITY</code> Values : yes | no Default value : yes Context : global, multisite If set to yes, the ModSecurity WAF will be enabled. You can include custom rules by adding .conf files into the /modsec-confs/ directory inside the container (i.e : through a volume). <code>USE_MODSECURITY_CRS</code> Values : yes | no Default value : yes Context : global, multisite If set to yes, the <a href="https://coreruleset.org/" rel="nofollow" target="_blank" title="OWASP ModSecurity Core Rule Set">OWASP ModSecurity Core Rule Set</a> will be used. It provides generic rules to detect common web attacks. You can customize the CRS (i.e. : add WordPress exclusions) by adding custom .conf files into the /modsec-crs-confs/ directory inside the container (i.e : through a volume). Files inside this directory are included before the CRS rules. If you need to tweak (i.e. : SecRuleUpdateTargetById) put .conf files inside the /modsec-confs/ which is included after the CRS rules. Security headers <code>X_FRAME_OPTIONS</code> Values : DENY | SAMEORIGIN | ALLOW-FROM <a href="https://www.website.net" rel="nofollow" target="_blank" title="https://www.website.net">https://www.website.net</a> | ALLOWALL Default value : DENY Context : global, multisite Policy to be used when the site is displayed through iframe. Can be used to mitigate <a href="https://www.kitploit.com/search/label/ClickJacking" target="_blank" title="clickjacking">clickjacking</a> attacks. More info <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options" rel="nofollow" target="_blank" title="here">here</a>. <code>X_XSS_PROTECTION</code> Values : 0 | 1 | 1; mode=block Default value : 1; mode=block Context : global, multisite Policy to be used when XSS is detected by the browser. Only works with Internet Explorer. More info <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection" rel="nofollow" target="_blank" title="here">here</a>. <code>X_CONTENT_TYPE_OPTIONS</code> Values : nosniff Default value : nosniff Context : global, multisite Tells the browser to be strict about MIME type. More info <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options" rel="nofollow" target="_blank" title="here">here</a>. <code>REFERRER_POLICY</code> Values : no-referrer | no-referrer-when-downgrade | origin | origin-when-cross-origin | same-origin | strict-origin | strict-origin-when-cross-origin | unsafe-url Default value : no-referrer Context : global, multisite Policy to be used for the Referer header. More info <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy" rel="nofollow" target="_blank" title="here">here</a>. <code>FEATURE_POLICY</code> Values : <directive> <allow list> Default value : accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'none'; camera 'none'; display-capture 'none'; document-domain 'none'; encrypted-media 'none'; fullscreen 'none'; <a href="https://www.kitploit.com/search/label/Geolocation" target="_blank" title="geolocation">geolocation</a> 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; payment 'none'; picture-in-picture 'none'; speaker 'none'; sync-xhr 'none'; usb 'none'; vibrate 'none'; vr 'none' Context : global, multisite Tells the browser which features can be used on the website. More info <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy" rel="nofollow" target="_blank" title="here">here</a>. <code>PERMISSIONS_POLICY</code> Values : feature=(allow list) Default value : accelerometer=(), ambient-light-sensor=(), autoplay=(), camera=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), speaker=(), sync-xhr=(), usb=(), vibrate=(), vr=() Context : global, multisite Tells the browser which features can be used on the website. More info <a href="https://www.w3.org/TR/permissions-policy-1/" rel="nofollow" target="_blank" title="here">here</a>. <code>COOKIE_FLAGS</code> Values : * HttpOnly | MyCookie secure SameSite=Lax | ... Default value : * HttpOnly SameSite=Lax Context : global, multisite Adds some security to the cookies set by the server. Accepted value can be found <a href="https://github.com/AirisX/nginx_cookie_flag_module" rel="nofollow" target="_blank" title="here">here</a>. <code>COOKIE_AUTO_SECURE_FLAG</code> Values : yes | no Default value : yes Context : global, multisite When set to yes, the secure will be automatically added to cookies when using HTTPS. <code>STRICT_TRANSPORT_POLICY</code> Values : max-age=expireTime [; includeSubDomains] [; preload] Default value : max-age=31536000 Context : global, multisite Tells the browser to use exclusively HTTPS instead of HTTP when communicating with the server. More info <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security" rel="nofollow" target="_blank" title="here">here</a>. <code>CONTENT_SECURITY_POLICY</code> Values : <directive 1>; <directive 2>; ... Default value : default-src 'self'; frame-ancestors 'self'; form-action 'self'; block-all-mixed-content; sandbox allow-forms allow-same-origin allow-scripts; reflected-xss block; base-uri 'self'; referrer no-referrer Context : global, multisite Policy to be used when loading resources (scripts, forms, frames, ...). More info <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy" rel="nofollow" target="_blank" title="here">here</a>. Blocking Antibot <code>USE_ANTIBOT</code> Values : no | cookie | javascript | captcha | recaptcha Default value : no Context : global, multisite If set to another allowed value than no, users must complete a "challenge" before accessing the pages on your website : <ul> <li>cookie : asks the users to set a cookie</li> <li>javascript : users must execute a javascript code</li> <li>captcha : a text captcha must be resolved by the users</li> <li>recaptcha : use <a href="https://developers.google.com/recaptcha/intro" rel="nofollow" target="_blank" title="Google reCAPTCHA v3">Google reCAPTCHA v3</a> score to allow/deny users</li> </ul> <code>ANTIBOT_URI</code> Values : <any valid uri> Default value : /challenge Context : global, multisite A valid and unused URI to redirect users when <code>USE_ANTIBOT</code> is used. Be sure that it doesn't exist on your website. <code>ANTIBOT_SESSION_SECRET</code> Values : random | <32 chars of your choice> Default value : random Context : global, multisite A secret used to generate sessions when <code>USE_ANTIBOT</code> is set. Using the special random value will generate a random one. Be sure to use the same value when you are in a multi-server environment (so sessions are valid in all the servers). <code>ANTIBOT_RECAPTCHA_SCORE</code> Values : <0.0 to 1.0> Default value : 0.7 Context : global, multisite The minimum score required when <code>USE_ANTIBOT</code> is set to recaptcha. <code>ANTIBOT_RECAPTCHA_SITEKEY</code> Values : <public key given by Google> Default value : Context : global The sitekey given by Google when <code>USE_ANTIBOT</code> is set to recaptcha. <code>ANTIBOT_RECAPTCHA_SECRET</code> Values : <private key given by Google> Default value : Context : global The secret given by Google when <code>USE_ANTIBOT</code> is set to recaptcha. External blacklists <code>BLOCK_USER_AGENT</code> Values : yes | no Default value : yes Context : global, multisite If set to yes, block clients with "bad" user agent. Blacklist can be found <a href="https://raw.githubusercontent.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker/master/_generator_lists/bad-user-agents.list" rel="nofollow" target="_blank" title="here">here</a>. <code>BLOCK_TOR_EXIT_NODE</code> Values : yes | no Default value : yes Context : global, multisite Is set to yes, will block known TOR exit nodes. Blacklist can be found <a href="https://iplists.firehol.org/?ipset=tor_exits" rel="nofollow" target="_blank" title="here">here</a>. <code>BLOCK_PROXIES</code> Values : yes | no Default value : yes Context : global, multisite Is set to yes, will block known proxies. Blacklist can be found <a href="https://iplists.firehol.org/?ipset=firehol_proxies" rel="nofollow" target="_blank" title="here">here</a>. <code>BLOCK_ABUSERS</code> Values : yes | no Default value : yes Context : global, multisite Is set to yes, will block known abusers. Blacklist can be found <a href="https://iplists.firehol.org/?ipset=firehol_abusers_30d" rel="nofollow" target="_blank" title="here">here</a>. DNSBL <code>USE_DNSBL</code> Values : yes | no Default value : yes Context : global, multisite If set to yes, DNSBL checks will be performed to the servers specified in the <code>DNSBL_LIST</code> environment variable. <code>DNSBL_LIST</code> Values : <list of DNS zones separated with spaces> Default value : bl.blocklist.de problems.dnsbl.sorbs.net sbl.spamhaus.org xbl.spamhaus.org Context : global The list of DNSBL zones to query when <code>USE_DNSBL</code> is set to yes. CrowdSec <code>USE_CROWDSEC</code> Values : yes | no Default value : no Context : global, multisite If set to yes, <a href="https://github.com/crowdsecurity/crowdsec" rel="nofollow" target="_blank" title="CrowdSec">CrowdSec</a> will be enabled with the <a href="https://hub.crowdsec.net/author/crowdsecurity/collections/nginx" rel="nofollow" target="_blank" title="nginx collection">nginx collection</a>. API pulls will be done automaticaly. Custom whitelisting <code>USE_WHITELIST_IP</code> Values : yes | no Default value : yes Context : global, multisite If set to yes, lets you define custom IP addresses to be whitelisted through the <code>WHITELIST_IP_LIST</code> environment variable. <code>WHITELIST_IP_LIST</code> Values : <list of IP addresses separated with spaces> Default value : 23.21.227.69 40.88.21.235 50.16.241.113 50.16.241.114 50.16.241.117 50.16.247.234 52.204.97.54 52.5.190.19 54.197.234.188 54.208.100.253 54.208.102.37 107.21.1.8 Context : global The list of IP addresses to whitelist when <code>USE_WHITELIST_IP</code> is set to yes. The default list contains IP addresses of the <a href="https://help.duckduckgo.com/duckduckgo-help-pages/results/duckduckbot/" rel="nofollow" target="_blank" title="DuckDuckGo crawler">DuckDuckGo crawler</a>. <code>USE_WHITELIST_REVERSE</code> Values : yes | no Default value : yes Context : global, multisite If set to yes, lets you define custom reverse DNS suffixes to be whitelisted through the <code>WHITELIST_REVERSE_LIST</code> environment variable. <code>WHITELIST_REVERSE_LIST</code> Values : <list of reverse DNS suffixes separated with spaces> Default value : .googlebot.com .google.com .search.msn.com .crawl.yahoot.net .crawl.baidu.jp .crawl.baidu.com .yandex.com .yandex.ru .yandex.net Context : global The list of reverse DNS suffixes to whitelist when <code>USE_WHITELIST_REVERSE</code> is set to yes. The default list contains suffixes of major search engines. Custom blacklisting <code>USE_BLACKLIST_IP</code> Values : yes | no Default value : yes Context : global, multisite If set to yes, lets you define custom IP addresses to be blacklisted through the <code>BLACKLIST_IP_LIST</code> environment variable. <code>BLACKLIST_IP_LIST</code> Values : <list of IP addresses separated with spaces> Default value : Context : global The list of IP addresses to blacklist when <code>USE_BLACKLIST_IP</code> is set to yes. <code>USE_BLACKLIST_REVERSE</code> Values : yes | no Default value : yes Context : global, multisite If set to yes, lets you define custom reverse DNS suffixes to be blacklisted through the <code>BLACKLIST_REVERSE_LIST</code> environment variable. <code>BLACKLIST_REVERSE_LIST</code> Values : <list of reverse DNS suffixes separated with spaces> Default value : .shodan.io Context : global The list of reverse DNS suffixes to blacklist when <code>USE_BLACKLIST_REVERSE</code> is set to yes. Requests limiting <code>USE_LIMIT_REQ</code> Values : yes | no Default value : yes Context : global, multisite If set to yes, the amount of HTTP requests made by a user will be limited during a period of time. More info rate limiting <a href="https://www.nginx.com/blog/rate-limiting-nginx/" rel="nofollow" target="_blank" title="here">here</a>. <code>LIMIT_REQ_RATE</code> Values : Xr/s | Xr/m Default value : 20r/s Context : global, multisite The rate limit to apply when <code>USE_LIMIT_REQ</code> is set to yes. Default is 10 requests per second. <code>LIMIT_REQ_BURST</code> Values : <any valid integer> Default value : 40 Context : global, multisite The number of of requests to put in queue before rejecting requests. <code>LIMIT_REQ_CACHE</code> Values : Xm | Xk Default value : 10m Context : global The size of the cache to store information about request limiting. Countries <code>BLACKLIST_COUNTRY</code> Values : <country code 1> <country code 2> ... Default value : Context : global, multisite Block some countries from accessing your website. Use 2 letters country code separated with space. <code>WHITELIST_COUNTRY</code> Values : <country code 1> <country code 2> ... Default value : Context : global, multisite Only allow specific countries accessing your website. Use 2 letters country code separated with space. PHP <code>REMOTE_PHP</code> Values : <any valid IP/hostname> Default value : Context : global, multisite Set the IP/hostname address of a remote PHP-FPM to execute .php files. See <code>USE_PHP</code> if you want to run a PHP-FPM instance on the same container as bunkerized-nginx. <code>REMOTE_PHP_PATH</code> Values : <any valid absolute path> Default value : /app Context : global, multisite The path where the PHP files are located inside the server specified in <code>REMOTE_PHP</code>. Fail2ban <code>USE_FAIL2BAN</code> Values : yes | no Default value : yes Context : global, multisite If set to yes, fail2ban will be used to block users getting too much "strange" HTTP codes in a period of time. Instead of using iptables which is not possible inside a container, fail2ban will dynamically update nginx to ban/unban IP addresses. If a number (<code>FAIL2BAN_MAXRETRY</code>) of "strange" HTTP codes (<code>FAIL2BAN_STATUS_CODES</code>) is found between a time interval (<code>FAIL2BAN_FINDTIME</code>) then the originating IP address will be ban for a specific period of time (<code>FAIL2BAN_BANTIME</code>). <code>FAIL2BAN_STATUS_CODES</code> Values : <HTTP status codes separated with | char> Default value : 400|401|403|404|405|444 Context : global List of "strange" error codes that fail2ban will search for. <code>FAIL2BAN_BANTIME</code> Values : Default value : 3600 Context : global The duration time, in seconds, of a ban. <code>FAIL2BAN_FINDTIME</code> Values : Default : value : 60 Context : global The time interval, in seconds, to search for "strange" HTTP status codes. <code>FAIL2BAN_MAXRETRY</code> Values : <any positive integer> Default : value : 15 Context : global The number of "strange" HTTP status codes to find between the time interval. ClamAV <code>USE_CLAMAV_UPLOAD</code> Values : yes | no Default value : yes Context : global, multisite If set to yes, ClamAV will scan every file uploads and block the upload if the file is detected. <code>USE_CLAMAV_SCAN</code> Values : yes | no Default value : yes Context : global If set to yes, ClamAV will scan all the files inside the container every day. <code>CLAMAV_SCAN_REMOVE</code> Values : yes | no Default value : yes Context : global If set to yes, ClamAV will automatically remove the detected files. Misc <code>ADDITIONAL_MODULES</code> Values : <list of packages separated with space> Default value : Context : global You can specify additional modules to install. All <a href="https://pkgs.alpinelinux.org/packages" rel="nofollow" target="_blank" title="alpine packages">alpine packages</a> are valid. <code>LOGROTATE_MINSIZE</code> Values : x | xk | xM | xG Default value : 10M Context : global The minimum size of a log file before being rotated (no letter = bytes, k = kilobytes, M = megabytes, G = gigabytes). <code>LOGROTATE_MAXAGE</code> Values : <any integer> Default value : 7 Context : global The number of days before rotated files are deleted. Include custom configurations Custom configurations files (ending with .conf suffix) can be added in some directory inside the container : <ul> <li>/http-confs : http context</li> <li>/server-confs : server context</li> </ul> You just need to use a volume like this : <div><pre><code>docker run ... -v /path/to/http/confs:/http-confs:ro ... -v /path/to/server/confs:/server-confs:ro ... bunkerity/bunkerized-nginx</code></pre></div> When <code>MULTISITE</code> is set to yes, .conf files inside the /server-confs directory are loaded by all the server blocks. You can also set custom configuration for a specific server block by adding files in a subdirectory named as the host defined in the <code>SERVER_NAME</code> environment variable. Here is an example : <div><pre><code>docker run ... -v /path/to/server/confs:/server-confs:ro ... -e MULTISITE=yes -e "SERVER_NAME=app1.domain.com app2.domain.com" ... bunkerity/bunkerized-nginx</code></pre></div> The /path/to/server/confs directory should have a structure like this : <pre><code>/path/to/server/confs ├── app1.domain.com │   └── custom.conf │   └── ... └── app2.domain.com └── custom.conf └── ... </code></pre> Cache data You can store cached data (blacklists, geoip DB, ...) to avoid downloading them again after a container deletion by mounting a volume on the /cache directory : <div><pre><code>docker run ... -v /path/to/cache:/cache ... bunkerity/bunkerized-nginx</code></pre></div> <div style="text-align: center;"><a class="kiploit-download" href="https://github.com/bunkerity/bunkerized-nginx" rel="nofollow" target="_blank" title="Download Bunkerized-Nginx">Download Bunkerized-Nginx</a></div>Zion3R[email protected]

文章来源: http://www.blogger.com/feeds/8317222231133660547/posts/default/1072137038089131435
如有侵权请联系:admin#unsafe.sh