DevOps & cloud skills

Ensure that NGINX is run using a non-privileged, dedicated service account (Manual)

Ensure the NGINX service account is locked (Manual)

Ensure the NGINX service account has an invalid shell (Manual)

Ensure NGINX directories and files are owned by root (Manual)

Ensure access to NGINX directories and files is restricted (Manual)

Ensure the NGINX process ID (PID) file is secured (Manual)

Ensure NGINX only listens for network connections on authorized ports (Manual)

Ensure requests for unknown host names are rejected (Manual)

Ensure keepalive_timeout is 10 seconds or less, but not 0 (Manual)

Ensure send_timeout is set to 10 seconds or less, but not 0 (Manual)

Ensure server_tokens directive is set to off (Manual)

Ensure default error and index.html pages do not reference NGINX (Manual)

Ensure hidden file serving is disabled (Manual)

Ensure the NGINX reverse proxy does not enable information disclosure (Manual)

Ensure detailed logging is enabled (Manual)

Ensure access logging is enabled (Manual)

Ensure error logging is enabled and set to the info logging level (Manual)

Ensure proxies pass source IP information (Manual)

Ensure HTTP is redirected to HTTPS (Manual)

Ensure the upstream traffic server certificate is trusted (Manual)

Ensure Secure Session Resumption is Enabled (Manual)

Ensure HTTP/3.0 is used (Manual)

Ensure a trusted certificate and trust chain is installed (Manual)

Ensure only modern TLS protocols are used (Manual)