Ensure the latest software package is installed
Details As new security vulnerabilities are discovered, the corresponding fixes are implemented by your NGINX software package provider. Installing the...
- Home
- Security Hardening
- CIS Nginx Benchmark V1.0.0 L1 Proxy
CIS Nginx Benchmark V1.0.0 L1 Proxy
Ensure the maximum buffer size for URIs is defined
Details The large_client_header_buffers directive defines the number and size of buffers used within the URI. A request cannot exceed the...Ensure the maximum request body size is set correctly
Details The client_max_body_size directive sets the size of the request body that is allowed to read a client request. This...Ensure the NGINX process ID (PID) file is secured
Details The PID file stores the main process ID of the nginx process. This file should be protected from unauthorized...Ensure the NGINX reverse proxy does not enable information disclosure – Server
Details The server and x-powered-by header may specify the underlying technology used by an application. The NGINX reverse proxy may...Ensure the NGINX reverse proxy does not enable information disclosure – X-Powered-By
Details The server and x-powered-by header may specify the underlying technology used by an application. The NGINX reverse proxy may...Ensure the NGINX service account has an invalid shell
Details The nginx account should not have the ability to log in, so the /sbin/nologin shell should be set for...Ensure the NGINX service account is locked
Details The nginx user account should have a valid password, but the account should be locked. NOTE: If a different...Ensure timeout values for reading the client header and body are set correctly – client_body_timeout
Details The client_header_timeout and client_body_timeout directives define the time the server will wait for the header or body to be...Ensure timeout values for reading the client header and body are set correctly – client_header_timeout
Details The client_header_timeout and client_body_timeout directives define the time the server will wait for the header or body to be...