CSEC_PUBLIC/the-practical-linux-hardening-guide
1
0
Fork 0
mirror of https://github.com/trimstray/the-practical-linux-hardening-guide.git synced 2025-12-06 17:22:51 +01:00
Code Issues Packages Projects Releases Wiki Activity

Format

Browse Source 
- signed-off-by: ajvn <ivans@vaskir.co>
This commit is contained in:
ajvn
2019-01-31 22:10:25 +01:00
parent b2f7d697a4
commit f2bece9c86
1 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
README.md
View File

@@ -782,6 +782,7 @@ server {
#### :eight_pointed_black_star: Redirect all unencrypted traffic to HTTPS #### :eight_pointed_black_star: Redirect all unencrypted traffic to HTTPS
This config entry is responsible for permanently redirecting all HTTP traffic to HTTPS. It will redirect all visitors that try to access website through HTTP on port 80, to HTTPS on port 443: This config entry is responsible for permanently redirecting all HTTP traffic to HTTPS. It will redirect all visitors that try to access website through HTTP on port 80, to HTTPS on port 443:
`return 301 https://$host$request_uri;` `return 301 https://$host$request_uri;`
**Example config:** **Example config:**
@@ -820,6 +821,7 @@ When a user enters a web domain manually (providing the domain name without the
[Source](https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/) [Source](https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/)
Config entry : Config entry :
`add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;` `add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;`
**Example config** **Example config**
@@ -864,20 +866,34 @@ ssl_dhparam /etc/nginx/ssl/dhparam.pem;
#### :eight_pointed_black_star: Security related headers #### :eight_pointed_black_star: Security related headers
_Cross-site scripting (XSS) protection:_ _Cross-site scripting (XSS) protection:_
Helps with preventing XSS attacks, it's enabling cross-site scripting filter built into modern browsers. Helps with preventing XSS attacks, it's enabling cross-site scripting filter built into modern browsers.
`add_header x-xss-protection "1; mode=block" always;` `add_header x-xss-protection "1; mode=block" always;`
_X-Frame-Options:_ _X-Frame-Options:_
Prevents iframe loading from different websites: Prevents iframe loading from different websites:
`add_header x-frame-options "SAMEORIGIN" always;` `add_header x-frame-options "SAMEORIGIN" always;`
_X-Content-Type-Options:_ _X-Content-Type-Options:_
It helps reducing drive-by downloads: It helps reducing drive-by downloads:
`add_header X-Content-Type-Options "nosniff" always;` `add_header X-Content-Type-Options "nosniff" always;`
_HTTP Strict Transport Security (HSTS):_ _HTTP Strict Transport Security (HSTS):_
When a browser sees this header from an HTTPS website, it “learns” that this domain must only be accessed using HTTPS (SSL or TLS). It caches this information for the max-age period (typically 31,536,000 seconds, equal to about 1 year). When a browser sees this header from an HTTPS website, it “learns” that this domain must only be accessed using HTTPS (SSL or TLS). It caches this information for the max-age period (typically 31,536,000 seconds, equal to about 1 year).
`add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;` `add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;`
[Source 1](https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/) [Source 1](https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/)
[Source 2](https://www.owasp.org/index.php/OWASP_Secure_Headers_Project) [Source 2](https://www.owasp.org/index.php/OWASP_Secure_Headers_Project)