Any recommendations specifically designed for nginx? about mitigating-web-shells

[CyberRookie]

Maybe I'll check it out. I allready run Apache Tomcat and J-Boxss EAP server for MySQL and Persistence/Hibernate.

…

________________________________ From: Gwyneth Llewelyn <[email protected]> Sent: Wednesday, November 11, 2020 3:54 PM To: nsacyber/Mitigating-Web-Shells <[email protected]> Cc: Mark Stevens <[email protected]>; Comment <[email protected]> Subject: Re: [nsacyber/Mitigating-Web-Shells] Any recommendations specifically designed for nginx? (#6) It's a full-fledged server, created in 2004. It can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache. While the server itself is free and open-source (used, for instance, by Cloudflare... among a zillion other websites), there is a company behind it (Nginx, Inc.) which also develops something akin to 'containers', which they call 'a polyglot app server' (named 'Unit<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Funit.nginx.org%2F&data=04%7C01%7C%7C28f0c673a5884623984808d8869d3226%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637407356984967739%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=NtjqFDkKMvfN3gYW9x%2BsiLQoC6WtE7KPP0Zdc8SB33Q%3D&reserved=0>'). Nginx is also, according to Wikipedia, the most deployed web server on Docker containers (because it's small in size, needs few resources, and is blazingly fast). I'm actually surprised that you haven't heard about nginx before lol — after all, it is used by 4x as many websites as IIS, and, as said, almost as many as Apache... — You are receiving this because you commented. Reply to this email directly, view it on GitHub<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnsacyber%2FMitigating-Web-Shells%2Fissues%2F6%23issuecomment-725729561&data=04%7C01%7C%7C28f0c673a5884623984808d8869d3226%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637407356984967739%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=UXdSPp8OhI28o9IQxTdLN4MwrCgmfFX6zCV3J0A%2Fpn0%3D&reserved=0>, or unsubscribe<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAPLVTXIIRGZPQLQYPNDCPF3SPMP5DANCNFSM4SAIP2BA&data=04%7C01%7C%7C28f0c673a5884623984808d8869d3226%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637407356984972731%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=F3JxEH7SpU4wEipoqwlyMXz3HqemfnY2plO%2BXGdbXR4%3D&reserved=0>.

[CyberRookie]

I have not tried that service. Is it a container or a full-fledged server?

…

________________________________ From: Gwyneth Llewelyn <[email protected]> Sent: Thursday, October 1, 2020 3:56 AM To: nsacyber/Mitigating-Web-Shells <[email protected]> Cc: Subscribed <[email protected]> Subject: [nsacyber/Mitigating-Web-Shells] Any recommendations specifically designed for nginx? (#6) Hello, I've noticed that you have included several detailed instructions for Microsoft IIS as well as Apache. I wonder if you could also make some recommendations for nginx — it's an increasingly popular web server<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fw3techs.com%2Ftechnologies%2Foverview%2Fweb_server&data=02%7C01%7C%7C259820d8bbaf4ddfb1e808d865f8aba7%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637371465983420939&sdata=uAk0ggQ3EfHaSNAazqds8X%2FMC2ORtCDrU%2BFH01G4zkU%3D&reserved=0>, with almost as much market share as Apache. While web server log analysis can be used with relative facility (nginx can write its logs in Apache format), other tools mentioned on your documentation do not apply. Thanks in advance! — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnsacyber%2FMitigating-Web-Shells%2Fissues%2F6&data=02%7C01%7C%7C259820d8bbaf4ddfb1e808d865f8aba7%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637371465983420939&sdata=Zw3OwrKs4lqxFzxoB6oifu66GrEXC4Wn6SXLIRq71eU%3D&reserved=0>, or unsubscribe<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAPLVTXOYA3YS6J6A2Z6Y443SIRN6LANCNFSM4SAIP2BA&data=02%7C01%7C%7C259820d8bbaf4ddfb1e808d865f8aba7%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637371465983430934&sdata=NvHfCKFQf0nd%2FnODhrH71gxEGynGaIDvjWe7DVNO0nQ%3D&reserved=0>.

[GwynethLlewelyn]

It's a full-fledged server, created in 2004. It can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache. While the server itself is free and open-source (used, for instance, by Cloudflare... among a zillion other websites), there is a company behind it (Nginx, Inc.) which also develops something akin to 'containers', which they call 'a polyglot app server' (named 'Unit'). Nginx is also, according to Wikipedia, the most deployed web server on Docker containers (because it's small in size, needs few resources, and is blazingly fast).

I'm actually surprised that you haven't heard about nginx before lol — after all, it is used by 4x as many websites as IIS, and, as said, almost as many as Apache...

[GwynethLlewelyn]

While you can most certainly run Apache Tomcat behind nginx (the configuration on that page is a bit simplistic and not for Red Hat, but Ubuntu/Debian; to get the full advantages of nginx, it requires a bit more of tweaking — namely, to properly cache requests and work as a low-mem, low-CPU, high-performance reverse proxy, even serving static content such as images and CSS/JS files directly from the disk, bypassing Tomcat completely...), I could not read much about J-Boxss EAP, which is a commercial product, and it's possible that it runs 'behind' Apache... so I guess that you wouldn't profit a lot from nginx in that scenario.

[iadgovuser41]

Hi GwynethLlewelyn,
We currently don't have additional instructions for nginx but we'll consider adding this in a future revision. In the mean time, if there are any specific nginx instructions that you believe would be valuable, please submit them and we'll review for possible inclusion in the guidance.