SystemSh0cker/gocsaf
1
0
Fork 0
mirror of https://github.com/gocsaf/csaf.git synced 2025-12-22 05:40:11 +01:00
Code Issues Releases Activity Actions

Improve nginx setup docs (#182)

Browse source 
* Change nginx config to return 403 on unauthorized access to
   the non-white TLP locations. We cannot hide the existence anyway,
   as it is listed in the provider-metadata.json, even when restricted.
This commit is contained in:
Bernhard E. Reiter 2022-06-14 13:19:30 +02:00 • committed by GitHub
parent 2961a70bf2
commit 1e9d31277d
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 2 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/client-certificate-setup.md
View file

@ -6,7 +6,7 @@ a web browser.
### Configure nginx ### Configure nginx
Assuming the relevant server block is in `/etc/nginx/sites-enabled/default` and the CA used to verify the client certificates is under `/etc/ssl/`, Assuming the relevant server block is in `/etc/nginx/sites-enabled/default` and the CA used to verify the client certificates is under `/etc/ssl/`,
adjust the content of the `server{}` block like shown in the following example: adjust the content of the `server{}` block like shown in the following example:
<!-- MARKDOWN-AUTO-DOCS:START (CODE:src=../docs/scripts/TLSClientConfigsForITest.sh&lines=25-40) --> <!-- MARKDOWN-AUTO-DOCS:START (CODE:src=../docs/scripts/TLSClientConfigsForITest.sh&lines=25-38) -->
<!-- The below code snippet is automatically added from ../docs/scripts/TLSClientConfigsForITest.sh --> <!-- The below code snippet is automatically added from ../docs/scripts/TLSClientConfigsForITest.sh -->
```sh ```sh
ssl_client_certificate '${SSL_CLIENT_CERTIFICATE}'; # e.g. ssl_client_certificate /etc/ssl/rootca-cert.pem; ssl_client_certificate '${SSL_CLIENT_CERTIFICATE}'; # e.g. ssl_client_certificate /etc/ssl/rootca-cert.pem;

4
docs/scripts/TLSClientConfigsForITest.sh
View file

@ -33,9 +33,7 @@ echo '
autoindex on; autoindex on;
# in this location access is only allowed with client certs # in this location access is only allowed with client certs
if ($ssl_client_verify != SUCCESS){ if ($ssl_client_verify != SUCCESS){
# we use status code 404 == "Not Found", because we do return 403;
# not want to reveal if files within this location exist or not.
return 404;
} }
} }
'> ~/${FOLDERNAME}/clientCertificateConfigs.txt '> ~/${FOLDERNAME}/clientCertificateConfigs.txt