mirror of
https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker.git
synced 2025-09-01 10:09:49 +00:00
136 lines
6.2 KiB
Text
136 lines
6.2 KiB
Text
##############################################################################
|
|
# _ __ _ #
|
|
# / |/ /__ _(_)__ __ __ #
|
|
# / / _ `/ / _ \\ \ / #
|
|
# /_/|_/\_, /_/_//_/_\_\ #
|
|
# __/___/ __ ___ __ ___ __ __ #
|
|
# / _ )___ ____/ / / _ )___ / /_ / _ )/ /__ ____/ /_____ ____ #
|
|
# / _ / _ `/ _ / / _ / _ \/ __/ / _ / / _ \/ __/ '_/ -_) __/ #
|
|
# /____/\_,_/\_,_/ /____/\___/\__/ /____/_/\___/\__/_/\_\\__/_/ #
|
|
# #
|
|
##############################################################################
|
|
|
|
# ------------------------------------------------------------------------------
|
|
# MIT License
|
|
# ------------------------------------------------------------------------------
|
|
# Copyright (c) 2017 Mitchell Krog - mitchellkrog@gmail.com
|
|
# https://github.com/mitchellkrogza
|
|
# ------------------------------------------------------------------------------
|
|
# Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
# of this software and associated documentation files (the "Software"), to deal
|
|
# in the Software without restriction, including without limitation the rights
|
|
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
# copies of the Software, and to permit persons to whom the Software is
|
|
# furnished to do so, subject to the following conditions:
|
|
# ------------------------------------------------------------------------------
|
|
# The above copyright notice and this permission notice shall be included in all
|
|
# copies or substantial portions of the Software.
|
|
# ------------------------------------------------------------------------------
|
|
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
# SOFTWARE.
|
|
# ------------------------------------------------------------------------------
|
|
|
|
# ----------------------------------------
|
|
# Recommended SSL Settings for Nginx Sites
|
|
# ----------------------------------------
|
|
|
|
# Last Updated: 2019-07-04
|
|
|
|
# globalssl.conf
|
|
# Global ssl configuration file.
|
|
# Should be included in each and every server {} block of your https/ssl sites.
|
|
# Only use this if you know what you are doing with SSL, this is merely an example of
|
|
# good SSL settings for nginx ssl sites.
|
|
# NO SUPPORT IS OFFERED IN THIS REPO FOR SETTING UP AND RUNNING SSL
|
|
# There is lots of help for Let's Encrypt at: https://community.letsencrypt.org/
|
|
|
|
# To use this set of rules, add the include below into each server block.
|
|
# add this at the very top of your HTTPS server blocks before any other location rules
|
|
# include /etc/nginx/ssl.d/globalssl.conf;
|
|
|
|
|
|
##
|
|
# DIFFIE HELMAN ENCRYPTION / DHE
|
|
##
|
|
|
|
# Diffie-Hellman parameter for DHE ciphersuites, recommended 4096 bits
|
|
# Requires generating your dhparam.pem
|
|
# INSTRUCTIONS:
|
|
# -------------
|
|
# cd /etc/nginx/ssl
|
|
# sudo openssl dhparam -out dhparam.pem 4096
|
|
# WAIT FOR IT TO FINISH - Can take a long time
|
|
|
|
ssl_dhparam /etc/nginx/ssl/dhparam.pem;
|
|
|
|
##
|
|
# SSL SESSION SETTINGS
|
|
##
|
|
|
|
ssl_session_timeout 10m;
|
|
ssl_session_cache shared:SSL:128m;
|
|
ssl_session_tickets off;
|
|
|
|
##
|
|
# SSL PROTOCOL SUPPORT
|
|
# Support modern and intermediate browsers
|
|
# If you want to allow some older browsers add TLSv1 (but then you will need to review the ciphers below and use the OLD set of ciphers from Mozilla)
|
|
##
|
|
|
|
ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
|
|
|
|
##
|
|
# -----------
|
|
# SSL CIPHERS
|
|
# -----------
|
|
# Ciphers below are the strongest and most recommened set as of 2019-07-04 (cipher recommendations change regularly)
|
|
# This is my own set of ciphers based on recommendations from https://www.immuniweb.com/ssl/
|
|
# and https://www.ssllabs.com/ssltest/
|
|
# You can optionally use ciphers recommended by https://mozilla.github.io/server-side-tls/ssl-config-generator/
|
|
# As we approach wider implementation and use of TLSv1.3 things will change even more
|
|
# As of this version and writing - Nginx does not support TLSv1.3 yet
|
|
##
|
|
|
|
##
|
|
# CIPHER COMPLIANCE
|
|
# ------------------------------------
|
|
# COMPLIANT to PCI DSS compliance
|
|
# COMPLIANT to HIPAA guidance
|
|
# COMPLIANT to NIST guidelines
|
|
# COMPLIANT to industry best practices
|
|
# ------------------------------------
|
|
##
|
|
|
|
# Enable modern TLS cipher suites - without ECDHE-RSA-CHACHA20-POLY1305 (POLY1305 is not recommended anymore)
|
|
# This cipher set is highly tested and supports modern and older clients without using weak ciphers of any sort
|
|
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
|
|
|
|
# TLSv1.2 only recommends this to be off
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
##
|
|
# HSTS (HTTP Strict Transport Security)
|
|
# https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security
|
|
##
|
|
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload; always;";
|
|
|
|
##
|
|
# OCSP Stapling
|
|
# fetch OCSP records from URL in ssl_certificate and cache them
|
|
##
|
|
|
|
ssl_stapling on;
|
|
ssl_stapling_verify on;
|
|
|
|
# Do not use resolvers for OCSP see comment in - https://scotthelme.co.uk/ocsp-stapling-speeding-up-ssl/
|
|
# http://disq.us/url?url=http%3A%2F%2Fblog.zorinaq.com%2Fnginx-resolver-vulns%2F%3AP2dn26U8hf5EMF__e_ZIRGBpc3E&cuid=2541595
|
|
# resolver 8.8.8.8 8.8.4.4 valid=300s;
|
|
# resolver_timeout 5s;
|
|
|
|
|