Nginx basic security: preventing HTTP scanning and brute force attacks

With the development of the Internet, network security issues have attracted more and more attention. For website administrators, protecting website security has become an essential task. HTTP scanning and brute force attacks are one of the common attack methods at present, and they all need to be paid attention to.

In order to ensure the security of the website, many website administrators will use Nginx as the web server. Nginx not only supports high concurrent requests, but can also configure HTTP firewalls to protect websites from HTTP scanning and brute force attacks.

HTTP scanning attack

HTTP scanning is a passive attack. The attacker sends a large number of HTTP requests to find the weaknesses of the website. Attackers will scan open ports and services on the website, and then conduct vulnerability detection and attacks.

To protect the website from HTTP scanning attacks, you can take the following measures:

1. Disable unnecessary HTTP methods

Nginx enables all HTTP methods by default, such as GET, POST, PUT, DELETE, etc. In fact, in many cases, you only need to enable the GET and POST methods. Therefore, it is recommended that administrators turn off unnecessary HTTP methods. You can add the following configuration in the Nginx configuration file:

http {
  # 禁用PUT, DELETE等方法 
  if ($request_method !~ ^(GET|POST)$) {
    return 405;
  }
}

2. Limit HTTP request frequency

The attacker will continue to send requests to make the website The load is increased, making it unable to respond to requests from other normal users. In order to avoid this situation, we can set a limit on the frequency of HTTP requests, that is, limit the number of requests for a certain IP address within a certain period of time.

Use the ngx_http_limit_req module to limit client IP access frequency.

First define limit_req_zone in the http block, define a shared memory named req_zone, set the key size to 10k, and limit the request frequency to 10 times/s.

http {
  limit_req_zone $binary_remote_addr zone=req_zone:10k rate=10r/s;
}

Next, add the following configuration in the server or location block to be protected

server {
  limit_req zone=req_zone burst=5 nodelay;
}

When an IP exceeds 10 requests within 10s, because the request limit has been reached, then the server A 503 Service Unavailable error code will be returned, thereby limiting access frequency.

Brute force attack

A brute force attack is an active attack in which an attacker uses a large number of username and password combinations to try to gain access to a system or application. If the password is not strong enough, an attacker may be able to successfully crack the account password and take over the system.

In order to avoid brute force attacks, we can use the following measures:

1. Use HTTPS protocol

HTTPS protocol can encrypt transmission through TLS/SSL protocol to improve the transmission of data The security makes it impossible for attackers to obtain the user's account password. Using the HTTPS protocol is the most basic and effective measure to protect sensitive data transmission.

2. Use strong passwords

Using strong passwords can significantly reduce the cracking success rate of malicious attackers. The longer and more complex the password, the harder it is to crack. Administrators should encourage users to use strong passwords and use password policies to limit the use of weak passwords.

3. Use a limit on the number of login attempts

An attacker tries to log in multiple times, using different usernames and passwords, until they gain the correct login confidence. Administrators can configure modules that limit the number of login attempts, such as fail2ban, which can limit the number of login attempts according to certain rules to protect system security.

Summary

It is very important to protect the security of the website, and Nginx, as a high-performance web server, has strong functions to ensure the security of the website. By using the above measures, you can effectively prevent HTTP scanning and brute force attacks, helping administrators better protect the website.

The above is the detailed content of Nginx basic security: preventing HTTP scanning and brute force attacks. For more information, please follow other related articles on the PHP Chinese website!