diff --git a/deployment/bare_metal/old/setup_server_online_ubuntu18.sh b/deployment/bare_metal/old/setup_server_online_ubuntu18.sh index e8f766424..8782fa3b4 100644 --- a/deployment/bare_metal/old/setup_server_online_ubuntu18.sh +++ b/deployment/bare_metal/old/setup_server_online_ubuntu18.sh @@ -1,39 +1,4 @@ # nginx security -sudo cat << "EOF" > ssl.conf -## - # SSL Settings - ## - - # disable SSLv3(enabled by default since nginx 0.8.19) since it's less secure then TLS http://en.wikipedia.org/wiki/Secure_Sockets_Layer#SSL_3.0 - ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE - - # enables server-side protection from BEAST attacks - # http://blog.ivanristic.com/2013/09/is-beast-still-a-threat.html - ssl_prefer_server_ciphers on; - - # enable session resumption to improve https performance - # http://vincent.bernat.im/en/blog/2011-ssl-session-reuse-rfc5077.html - ssl_session_cache shared:SSL:50m; - ssl_session_timeout 1d; - ssl_session_tickets off; - - # ciphers chosen for forward secrecy and compatibility - # http://blog.ivanristic.com/2013/08/configuring-apache-nginx-and-openssl-for-forward-secrecy.html - ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS'; - - # enable ocsp stapling (mechanism by which a site can convey certificate revocation information to visitors in a privacy-preserving, scalable manner) - # http://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/ - resolver 8.8.8.8 8.8.4.4; - ssl_stapling on; - ssl_stapling_verify on; - # ssl_trusted_certificate /etc/nginx/ssl/star_forgott_com.crt; - - # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security - # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping - # also https://hstspreload.org/ - add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload"; -EOF - cd /etc/nginx/conf.d sudo cat < logging.conf log_format main '$http_x_forwarded_for - $remote_user [$time_local] '