NGINX Hardening and Optimizations (Enforcing HSTS, TLS/SSL Cipher Hardening, and Mask Internal Network Name)

The following steps require editing the unique NGINIX configuration file in /etc/nginx/conf.d/: 

sudo vi /etc/nginx/conf.d/*.conf

Enforcing HSTS

The remote web server is not enforcing HSTS, as defined by RFC 6797.  This can be achieved by adding the following configuration to NGINX:

Please add this after the second server { tag, before error page 502 /static/502.html

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Example:

server {
    listen       443 default ssl;
...

    location /static {
       root /usr/share/intigua/html;
    }
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    error_page 502 /static/502.html;
...

More information from NGINX.

TLS/SSL Cipher Hardening

Please add the following under # SSL section.  If the rows already existing, please update them to the following:

ssl_prefer_server_ciphers on;
ssl_protocols TLSv1.2;
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';

Reload / Restart NGNIX

After configuring, test for syntax and then restart

Now that server configured. It is time to test our nginx config server for syntax errors:

sudo nginx -t

Sample outputs:

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

Note: if you get a warning like the following, it's OK to remove that line

nginx: [warn] the "ssl" directive is deprecated, use the "listen ... ssl" directive instead in /etc/nginx/conf.d/intigua.nginx.conf:74

you can use :set number in vi to understand exact line number

Reload or restart the nginx server:

sudo systemctl restart nginx
## OR ##
sudo service nginx restart

Mask Internal Network Name / Private IP Address
Please add "server_name localhost;" to the configuration file /etc/nginx/nginx.conf  
This forces Nginx to always use the hostname "localhost" in its responses, masking the internal IP address.
It is important to add server {} inside http {}
Nginx

user nginx;
...
events {
  ...
}
http {
  server {
    ...
  }
}

Then restart the nginx service.
 
See below part of the nginx.conf:
 
http {
server {  # Server block starts here
    server_name localhost;  # Correct placement within the server block
 
    # Other server block directives here
  }  # Server block ends here

Download connector binaries from manager console with NGINX configuration

Step 1: Open the intigua.nginx.conf file:

vi /etc/nginx/conf.d/intigua.nginx.conf

Step 2: Add the following location block to enable directory listing for /connector/ (you can also use /static):

# Serve files and enable listing for /connector
location /connector/ {
alias /usr/share/intigua/bin/; # Map /connector to /usr/share/intigua/bin
autoindex on; # Enable directory listing
autoindex_exact_size off; # Show human-readable file sizes
autoindex_localtime on; # Display file timestamps in local time
}

Step 3: Test the NGINX Configuration

nginx -t

Confirm that the output says "syntax is okay" and "test is successful."

Step 4: Reload NGINX to Apply Changes

systemctl reload nginx

You should be able to see and download the connectors in UI (example)