GitHub - yandex/gixy: Nginx configuration static analyzerYou signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
How To Secure Nginx on Ubuntu 14.04 | DigitalOcean
Nginx is a very secure and reliable web server even with a default setup. However, there are many ways to secure Nginx further. In this article, we will use open source software exclusively while trying to follow some popular web server hardening approaches and security standards. Namely, we’ll be talking about preventing information disclosure, enforcing encryption, performing audits, and limitin
Let's Encryptã§HTTPSサーãƒã‚’建ã¦ãŸã¤ã„ã§ã«SSL Labsã§A+評価をã‚ã–ã™ - sonickun.log
最近 Let's Encrypt ㌠Public Beta ã«ãªã£ãŸã¨ã„ã†ã“ã¨ã§ï¼Œè‡ªåˆ†ã®ã‚µã‚¤ãƒˆ(https://sonickun.xyz)ã‚‚SSL化ã—ã¦ã¿ãŸï¼Žã¾ãŸï¼Œã©ã†ã›ãªã‚‰SSL Labsã®ãƒ†ã‚¹ãƒˆã§A+ã‚’å–ã‚ŠãŸã„ã¨æ€ã„ã‚ã‚Œã“れ試行錯誤ã—ãŸã®ã§å‚™å¿˜éŒ²ã¨ã—ã¦æ®‹ã—ã¦ãŠã． Let's Encrypt letsencrypt.org Let's Encrypt ã¯ï¼ŒSSL/TLSサーãƒè¨¼æ˜Žæ›¸ã®å–得・管ç†ã‚’簡略化ã§ãã‚‹ç„¡æ–™ã®ã‚µãƒ¼ãƒ“スã§ã‚り，TLSã‚„HTTPSã‚’æ™®åŠã•ã›ã‚‹ã“ã¨ã‚’目的ã¨ã—ã¦ã„る．Let's Encryptã§å–å¾—å¯èƒ½ãªSSL/TLSサーãƒè¨¼æ˜Žæ›¸ã¯ã€Œãƒ‰ãƒ¡ã‚¤ãƒ³èªè¨¼ (DV) SSL/TLS証明書ã€ã§ã‚り，独自ドメインã®æ‰€æœ‰è€…ã§ã‚ã‚Œã°èª°ã§ã‚‚å–å¾—å¯èƒ½ã§ã‚る．ä¼æ¥èªè¨¼(OV)SSL/TLS証明書やEV SSL証明書ã¯å–å¾—ã§ããªã„ãŒï¼Œå€‹äººãŒé‹å–¶ã™ã‚‹ã‚µã‚¤ãƒˆç¨‹åº¦ãªã‚‰DV証明書ã§å分ã¨ã„ãˆã‚‹ï¼Ž Let'
Apacheã‚„Nginxã®SSL関連ã®ãŠã™ã™ã‚è¨å®šã‚’生æˆã™ã‚‹ä¾¿åˆ©ã‚µã‚¤ãƒˆ - cakephperã®æ—¥è¨˜(CakePHP, Laravel, PHP)
Apacheã‚„Nginxã¨opensslã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚’指定ã™ã‚‹ã¨ãŠã™ã™ã‚ã®æš—å·ã‚¹ã‚¤ãƒ¼ãƒˆãªã©ã€SSLè¨å®šãƒ•ã‚¡ã‚¤ãƒ«ã‚’表示ã—ã¦ãれるMozillaã®ã‚µã‚¤ãƒˆãŒã‚ã‚Šã¾ã™ã€‚ https://mozilla.github.io/server-side-tls/ssl-config-generator/ ã“れを使ãˆã°å®‰å…¨ãªæš—å·ã‚¹ã‚¤ãƒ¼ãƒˆã®ã¿ã‚’使ã£ã¦ã‚‹è¨å®šãªã©ãŒç°¡å˜ã«ç”Ÿæˆã•ã‚Œã¾ã™ã®ã§ã€ã“ã®é€šã‚Šã«æŒ‡å®šã™ã‚Œã°è‰¯ã„ã§ã™ã€‚ Apacheã®å ´åˆã¯ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§ã¯æš—å·ã‚¹ã‚¤ãƒ¼ãƒˆè¨å®šã®è¨˜è¿°ã¯ãªã‹ã£ãŸã¨æ€ã„ã¾ã™ãŒã€ä¸‹è¨˜ã®3ã¤ã¯è¡¨ç¤ºé€šã‚Šã«æŒ‡å®šã—ã¦ãŠãã®ãŒè‰¯ã„ã‹ã¨æ€ã„ã¾ã™ã€‚ SSLProtocol SSLCipherSuite SSLHonorCipherOrder Oldã‚’é¸æŠžã™ã‚‹ã¨ã€å¤ã„ブラウザã«ã‚‚対応ã—ã¦ã‚‹æš—å·ã‚¹ã‚¤ãƒ¼ãƒˆã‚’å«ã‚ã¾ã™ã€‚ãŸã æš—å·å¼·åº¦ãŒå¼±ã„ã‚‚ã®ãŒå«ã¾ã‚Œã‚‹ãŸã‚サイトã®ã‚¢ã‚¯ã‚»ã‚¹å‚¾å‘ã‚’ã¿ã¦å¤ã„ブラウザã®ã‚¢ã‚¯ã‚»ã‚¹ãŒç„¡ã„ã®ã§ã‚ã‚Œ
Nginxã§HTTPS : ゼãƒã‹ã‚‰å§‹ã‚ã¦SSLã®è©•ä¾¡ã‚’A+ã«ã™ã‚‹ã¾ã§ Part 1 | POSTD
æ•°å¹´å‰ã€Webã¯å…¨ä½“çš„ã«æš—å·åŒ–ã•ã‚Œã¦ã„ã¾ã›ã‚“ã§ã—ãŸã€‚HTTPSã¯Webページã®æœ€ã‚‚é‡è¦ãªéƒ¨åˆ†ã ã‘ã®ãŸã‚ã«ç¢ºä¿ã•ã‚Œã¦ã„ã¾ã—ãŸã€‚æš—å·åŒ–ãŒå¿…è¦ãªã®ã¯å¤§åˆ‡ãªãƒ¦ãƒ¼ã‚¶ãƒ‡ãƒ¼ã‚¿ã ã‘ã§ã€Webページã®å…¬é–‹ã•ã‚Œã‚‹éƒ¨åˆ†ã¯æš—å·åŒ–ã›ãšã«é€ã£ã¦ã‚‚ã„ã„ã¨ã„ã†ã“ã¨ã§æ„見ãŒä¸€è‡´ã—ã¦ã„ã¾ã—ãŸã€‚ ã—ã‹ã—ã€ ä»Šã¯ çŠ¶æ³ ãŒ é•ã„ã¾ã™ 。ç¾åœ¨ã§ã¯ã€ã©ã‚“ãªWebトラフィックã§ã‚‚æš—å·åŒ–ã•ã‚Œã¦ã„ãªã„ã®ã¯è‰¯ããªã„ã¨ã„ã†ã“ã¨ãŒåˆ†ã‹ã£ã¦ã„ã‚‹ã®ã§ã€Webサイトをé‹å–¶ã™ã‚‹èª°ã‚‚ãŒã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã«é–¢ä¿‚ãªã強固ãªHTTPSã‚’è¨å®šã—ãªã‘ã‚Œã°ãªã‚Šã¾ã›ã‚“。 ãŠæ¥ãšã‹ã—ã„話ã§ã™ãŒã€ç§è‡ªèº«ã®Webサイトã¯2å¹´è¿‘ãã‚‚å…¨ãHTTPSをサãƒãƒ¼ãƒˆã—ã¦ã„ã¾ã›ã‚“ã§ã—㟠^(1) 。 Eric Mill 㮠今ã™ãç„¡æ–™ã§HTTPSã«åˆ‡ã‚Šæ›¿ãˆã‚ˆã† ã¨ã„ã†ç´ 晴らã—ã„記事ãŒæœ€çµ‚çš„ã«ç§ã«å–を入れã¦ãã‚Œã¾ã—ãŸã€‚ç§ã¯ä¼‘暇ä¸ã€HTTPSをセットアップã—㦠Qualys SSL Report ã§
我々ã¯ã©ã®ã‚ˆã†ã«ã—ã¦å®‰å…¨ãªHTTPS通信をæä¾›ã™ã‚Œã°è‰¯ã„ã‹ - Qiita
Modern Ciphersuite: ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES1
ç´°ã‹ã™ãŽã¦ä¼ã‚らãªã„SSL/TLS
ãƒ¤ãƒ•ãƒ¼æ ªå¼ä¼šç¤¾ã¯ã€2023å¹´10月1æ—¥ã«LINEãƒ¤ãƒ•ãƒ¼æ ªå¼ä¼šç¤¾ã«ãªã‚Šã¾ã—ãŸã€‚LINEãƒ¤ãƒ•ãƒ¼æ ªå¼ä¼šç¤¾ã®æ–°ã—ã„ブãƒã‚°ã¯ã“ã¡ã‚‰ã§ã™ã€‚LINEヤフー Tech Blog 「細ã‹ã„ã¨è¨€ã†ã‚ˆã‚Šé•·ã„よã〠ã¯ã˜ã‚ã« ã“ã‚“ã«ã¡ã¯ã€‚ATS ã®è„†å¼±æ€§ã‚’発見ã—ãŸå°æŸ´ã•ã‚“ã‚„ ATS ã« HTTP/2 ã®å®Ÿè£…ã‚’è¡Œã£ã¦ã„る大久ä¿ã•ã‚“ã¨åŒã˜ãƒãƒ¼ãƒ ã®ä¸€å¹´ç›®ã€åŒ¿å社員M ã•ã‚“ã‹ã‚‰ã„ã˜ã‚‰ã‚Œã¦ã„る新人ã§ã™ã€‚今回ã‚ã‚ŠãŒãŸã„事ã«ã€ã“ã†ã„ã£ãŸã™ã”ã„方々をå«ã‚モヒカン諸先輩方より「何ã‹æ›¸ã‹ãªã„ã®ï¼Ÿã€ã€Œã„ã¤æ›¸ãã®ï¼Ÿã€ã¨ã„ã†æ•°ã€…ã®ãƒ—レッシャーãŠè¨€è‘‰ã‚’ã„ãŸã ãã¾ã—ãŸã€‚ ã¨ã„ã†ã‚ã‘ã§ã€SSL/TLS ã® Session å†é–‹æ©Ÿèƒ½ã«é–¢ã—ã¦æ›¸ã„ã¦ã„ã“ã†ã‹ã¨æ€ã„ã¾ã™ã€‚ SSL/TLS ã¯æ©Ÿå¯†æ€§ã€å®Œå…¨æ€§ãã—ã¦çœŸæ£æ€§ã«å¯¾ã—ã¦å®‰å…¨ãªé€šä¿¡ã‚’è¡Œã†ãŸã‚ã®ä»•çµ„ã¿ã§ã™ã€‚ã—ã‹ã—ã€ã“ã®ä»•çµ„ã¿ã¯æš—å·æŠ€è¡“を多用ã—特ã«æŽ¥ç¶šã«ãŠã„ã¦è¤‡é›‘ãªãƒ—ãƒãƒˆã‚³ãƒ«ã‚’用ã„ã€Client, Se
SSL 3.0 を無効ã«è¨å®šã™ã‚‹æ–¹æ³•(POODLE対応) apache+mod_ssl, nginx - Qiita
SSL 3.0ã®è„†å¼±æ€§ CVE-2014-3566 aka POODLE ã®å¯¾å¿œã§SSL v3を無効ã«ã™ã‚‹å¿…è¦ã‚ã‚Š http://www.itmedia.co.jp/news/articles/1410/15/news054.html http://googleonlinesecurity.blogspot.jp/2014/10/this-poodle-bites-exploiting-ssl-30.html https://blog.mozilla.org/security/2014/10/14/the-poodle-attack-and-the-end-of-ssl-3-0/ https://www.openssl.org/~bodo/ssl-poodle.pdf Apache httpd + mod_sslãªã‚‰ http://httpd.apache.org/docs/2.2/mod
1
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
httpsã ã‹ã‚‰ã¨ã„ã†ã ã‘ã§å®‰å…¨ï¼Ÿèª¿ã¹ãŸã‚‰æ€–ããªã£ã¦ããŸSSLã®è©±!？ - Qiita
http://blog.monoweb.info/article/2012021823.html
{{#tags}}- {{label}}
{{/tags}}