NGINX Hardening (Enforcing HSTS, TLS/SSL Cipher Hardening, and Mask Internal Network Name)

The following steps require editing the unique NGINIX configuration file in /etc/nginx/conf.d/: 

sudo vi /etc/nginx/conf.d/*.conf

Enforcing HSTS

The remote web server is not enforcing HSTS, as defined by RFC 6797.  This can be achieved by adding the following configuration to NGINX:

Please add this after the second server { tag, before error page 502 /static/502.html

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Example:

server {
    listen       443 default ssl;
...

    location /static {
       root /usr/share/intigua/html;
    }
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    error_page 502 /static/502.html;
...

More information from NGINX.

TLS/SSL Cipher Hardening

Please add the following under # SSL section.  If the rows already existing, please update them to the following:

ssl_prefer_server_ciphers on;
ssl_protocols TLSv1.2;
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';

Reload / Restart NGNIX

After configuring, test for syntax and then restart

Now that server configured. It is time to test our nginx config server for syntax errors:

sudo nginx -t

Sample outputs:

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

Note: if you get a warning like the following, it's OK to remove that line

nginx: [warn] the "ssl" directive is deprecated, use the "listen ... ssl" directive instead in /etc/nginx/conf.d/intigua.nginx.conf:74

you can use :set number in vi to understand exact line number

Reload or restart the nginx server:

sudo systemctl restart nginx
## OR ##
sudo service nginx restart

Mask Internal Network Name / Private IP Address
Please add "server_name localhost;" to the configuration file /etc/nginx/nginx.conf  
This forces Nginx to always use the hostname "localhost" in its responses, masking the internal IP address.
It is important to add server {} inside http {}
Nginx

user nginx;
...
events {
  ...
}
http {
  server {
    ...
  }
}

Then restart the nginx service.
 
See below part of the nginx.conf:
 
http {
server {  # Server block starts here
    server_name localhost;  # Correct placement within the server block
 
    # Other server block directives here
  }  # Server block ends here