• HTTP
• nginx

nginx

About

• HTTP

• http://nginx.org/

• 2-clause BSD-like license

• About nginx

• nginx security advisories

• NGINX Product Documentation

• nginx documentation

  • nginx documentation - Building nginx from Sources

• nginx books

• github.com nginx/nginx

• nginx documentation - Alphabetical index of directives

• Building nginx from Sources - Compile time options

Install

   1 apt install nginx

or install nginx from source

Configure

Basic server configuration

http2

https://www.nginx.com/blog/http2-module-nginx/

• Binary protocol
  • harder to debug
  • a tick faster
  • a bit less CPU usage
• Multiplexing
  • Lowers overhead of connection establishment
• Header compression
• Prioritization

/etc/nginx/sites-available/vhost.conf

   1 server {
   2     listen 443 ssl http2;
   3     listen [::]:443 ssl http2;
   4 …
   5 }

Streams

The directive stream may only be embedded in the context main.
nginx.org docs - Module ngx_stream_core_module #stream

Modules are included in the main configuration. So we can also include their configuration from there
/etc/nginx/modules-available/51-mod-stream_ff-sync.conf

   1 stream {
   2      upstream syncserver_backends {
   3          server wiki.1a.rockstable.it:8443;
   4      }
   5      server {
   6          listen 8443;
   7          proxy_pass syncserver_backends;
   8      }
   9 }

Now enable the config

   1 ln -s /etc/nginx/modules-available/51-mod-stream_ff-sync.conf \
   2        /etc/nginx/modules-enabled
   3 ### TEST CONFIGURATION
   4 nginx -t
   5 ### RELOAD THE SERVICE
   6 systemctl reload nginx.service

Basic Auth

• Module ngx_http_auth_basic_module

• Module ngx_http_core_module.html satisfy

• Restricting Access with HTTP Basic Authentication

Nginx supports

• crypt()

  • unix crypt (truncated to 8 chars + 12 bit entropy) insecure

  • $2y$ bcrypt (blowfish and crypt)

    • with configurable costs between 4 and 17 (very slow)

  • $5$ SHA-256 crypt()

  • $6$ SHA-512 crypt()

• apr1

  • salted MD5-based, 1000 rounds
  • APR is the acronym for the

    Apache Portable Runtime Library

• Password schemes as defined in

  RFC 2307

  • Only the following schemes are implemented: '{PLAIN}', '{SHA}' and '{SSHA}'
• plain passwords
  • on Windows and Netshare

For information on how to create a password file please see:
HTTP/Apache2#htpasswd

In your location configuration (or .htaccess) place the following lines

   1 location /restricted {
   2     auth_basic           "Restricted area";
   3     auth_basic_user_file private/htpasswd;
   4 
   5     # …
   6 }

   1 

   1 

   1 

   1