1|1加固方法和步骤
2|0加固方法和步骤
2|1检查当前Nginx安装过程使用的openssl版本
[root@server ~]# nginx -V nginx version: nginx/1.16.1 built by gcc 4.8.5 20150623 (Red Hat 4.8.5-39) (GCC) built with OpenSSL 1.0.2k-fips 26 Jan 2017 TLS SNI support enabled
2|2下载新版本Openssl
cd /tmp
wget https://www.openssl.org/source/openssl-1.1.0k.tar.gz tar zxvf openssl-1.1.0k.tar.gz -C /usr/local
2|3下载安装源码Nginx
yum install -y gcc gcc-c++ openssl-devel pcre-devel make zlib-devel wget wget http://nginx.org/download/nginx-1.14.2.tar.gz cd /root/nginx-1.14.2 ./configure --prefix=/usr/local/nginx1.14 --with-http_ssl_module --with-http_stub_status_mod&& make insule --with-openssl=/usr/local/openssl-1.1.0k make && make install
我之前make时如果将openssl放到root目录可能会编译报错,/usr/local就没报错,没报错就不要改下面文件了
# 错误信息 /bin/sh: line 2: ./config: No such file or directory
make[1]:*** [/usr/local/ssl/.openssl/include/openssl/ssl.h] Error 127
make[1]: Leaving directory `/usr/local/src/nginx-1.9.9'
make: *** [build] Error 2
解决方法
# 打开nginx源文件下的/usr/local/src/nginx-1.9.9/auto/lib/openssl/conf文件:
vi /root/nginx-1.14.2/auto/lib/openssl/conf
# 找到以下代码,差不多三四十行
CORE_INCS="$CORE_INCS $OPENSSL/.openssl/include"
CORE_DEPS="$CORE_DEPS $OPENSSL/.openssl/include/openssl/ssl.h"
CORE_LIBS="$CORE_LIBS $OPENSSL/.openssl/lib/libssl.a"
CORE_LIBS="$CORE_LIBS $OPENSSL/.openssl/lib/libcrypto.a"
CORE_LIBS="$CORE_LIBS $NGX_LIBDL"
# 修改成以下代码
CORE_INCS="$CORE_INCS $OPENSSL/include"
CORE_DEPS="$CORE_DEPS $OPENSSL/include/openssl/ssl.h"
CORE_LIBS="$CORE_LIBS $OPENSSL/lib/libssl.a"
CORE_LIBS="$CORE_LIBS $OPENSSL/lib/libcrypto.a"
CORE_LIBS="$CORE_LIBS $NGX_LIBDL"
2|4验证Nginx使用Openssl版本
[root@JD sbin]# ./nginx -V nginx version: nginx/1.14.2 built by gcc 4.8.5 20150623 (Red Hat 4.8.5-39) (GCC) built with OpenSSL 1.1.0k 28 May 2019 TLS SNI support enabled configure arguments: --prefix=/usr/local/nginx1.14 --with-http_ssl_module --with-http_stub_status_module --with-openssl=/usr/local/openssl-1.1.0k
3|0HTTP服务器的缺省banner
能让攻击者了解远程系统类型和远端HTTP Server信息以便进行下一步的攻击
3|1Nginx
一般Nginx我们都会隐藏版本号
# 在http{}里面加上
http {
include mime.types;
default_type application/octet-stream;
server_tokens off;
# 隐藏php版本只需要在php.ini配置文件修改expose_php = On改为expose_php=Off
# 但是我们访问时候还是能看到关键信息,让人窃取到你使用的是nginx
[root@JD nginx-1.14.2]# curl localhost -I
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Sep 2020 13:36:34 GMT
Content-Type: text/html
Content-Length: 612
Last-Modified: Wed, 09 Sep 2020 13:08:03 GMT
Connection: keep-alive
ETag: "5f58d3b3-264"
Accept-Ranges: bytes
由于Nignx没有提供相关配置项改变缺省banner,所以我们需要修改源码,隐藏Nginx软件名
# 我们可以隐藏掉server信息也可以制造假的server迷惑攻击者
# 修改第一个配置文件为nginx.h ls /usr/local/src/nginx-1.12.2/
auto CHANGES.ru configure html Makefile objs src
CHANGES conf contrib LICENSE man README
# 我们找到当初make之前的那个源码包
cd /usr/local/src/nginx-1.12.2/src/ vim core/nginx.h
# 修改下面三行 #define nginx_version 1012002
#define NGINX_VERSION "7.0" #define NGINX_VER "IIS/" NGINX_VERSION
#ifdef NGX_BUILD
#define NGINX_VER_BUILD NGINX_VER " (" NGX_BUILD ")"
#else
#define NGINX_VER_BUILD NGINX_VER
#endif #define NGINX_VAR "IIS"
# OR
#define nginx_version 1014002 #define NGINX_VERSION ""
#define NGINX_VER "UNKNOW/" NGINX_VERSION
#ifdef NGX_BUILD
#define NGINX_VER_BUILD NGINX_VER " (" NGX_BUILD ")"
#else
#define NGINX_VER_BUILD NGINX_VER
#endif
#define NGINX_VAR "NGINX"
#define NGX_OLDPID_EXT ".oldbin" #endif /* _NGINX_H_INCLUDED_ */
# 修改第二个配置文件为ngx_http_header_filter_module.c,49行
grep IIS http/ngx_http_header_filter_module.c
static u_char ngx_http_server_string[] = "Server:IIS" CRLF;
# OR
static u_char ngx_http_server_string[] = "" CRLF;
static u_char ngx_http_server_full_string[] = "" NGINX_VER CRLF;
static u_char ngx_http_server_build_string[] = "" NGINX_VER_BUILD CRLF;
# 修改第三个配置文件为ngx_http_special_response.c,对外页面报错时,他会控制是否展示敏感信息,修改如下列 21 static u_char ngx_http_error_full_tail[] = 22 "<hr><center>IIS</center>" CRLF 23 "</body>" CRLF 24 "</html>" CRLF 25 ; 26 27 28 static u_char ngx_http_error_build_tail[] = 29 "<hr><center>IIS</center>" CRLF 30 "</body>" CRLF 31 "</html>" CRLF 32 ;
# OR
static u_char ngx_http_error_full_tail[] =
"<hr><center>" NGINX_VER "</center>" CRLF
"</body>" CRLF
"</html>" CRLF ;
static u_char ngx_http_error_build_tail[] =
"<hr><center>" NGINX_VER_BUILD
"</center>" CRLF
"</body>" CRLF
"</html>" CRLF
;
# nginx -V 查看原来编译的参数,从新编译并且make && make install 才会生效,如果源码修改错误会编译不过去.如果编译前服务是启动的哪怕编译成功也是不生效的,需要重启服务.
# 编译,重启请看上面,接下来我们访问看下效果
[root@JD nginx1.14]# curl localhost -I
HTTP/1.1 200 OK
[root@JD nginx1.14]#
还有一种办法比较另类,我没试过
3|2Tomcat
1)我们可以编辑Tomcat(安装目录)/conf/server.xml 文件 ,找到我们应用程序端口对应的元素,新增 server="自定义" 属性,覆盖掉原来的server属性。
2) 重启服务即可
微信扫描下方的二维码阅读本文