Nginx on nagg.eu

We are in the cloud

Sat, 08 Jul 2023 00:00:00 +0000

We are in the cloud, running on someone else’s computer.

Keepalived and libvirt MACVTAP network interfaces

Wed, 13 Jan 2021 00:00:00 +0000

Keepalived is a routing software written in C that can be used to setup load balancing and high availiability for Linux machines.

NOTE: hypervisor is Debian 10 (Buster) with libvirt and qemu/kvm, virtual machines also are Debian 10 (Buster).

Keepalived configuration

Install keepalived:

$ apt install keepalived

Install nginx, it will be use to check that keepalived is actually working:

$ apt install nginx
$ systemctl enable --now nginx

Configure keepalived:

$ vi /etc/keepalived/keepalived.conf
---
global_defs {
 enable_script_security # prevents tampering with the check script
 script_user root # defines which user runs the check script
}

vrrp_script chk_nginx {
 script "/opt/scripts/nginx-check.sh"
 interval 2 # run script every 2 seconds
 weight 2 # add 2 points if OK
}

vrrp_instance VI_1 {
 interface enp2s0 # interface to monitor
 virtual_router_id 51
 priority 101 # MASTER 101, BACKUP 100
 advert_int 1
 nopreempt # comment to not have the VIP go back to MASTER 
 # -> when it comes back online
 authentication {
 auth_type PASS
 auth_pass myPass # maximum 8 chars
 }
 virtual_ipaddress {
 10.10.0.12/24 # VIP (Virtual IP Address)
 }
 track_script {
 chk_nginx
 }
}

Also add a script to check if nginx is alive and well:

FreeBSD, Nginx and htpasswd file generation

Sun, 01 Sep 2019 00:00:00 +0000

On most Linux distros it is possible to generate the htpasswd file entries simply using the htpasswd command line util.
On FreeBSD the easiest way to accomplish the same task is using OpenSSL itself:


openssl passwd -apr1

Enter the password twice to get a nice hash, copy that in the htpasswd file with the usual user:password_hash syntax.

FreeBSD, NGINX and TLSv1.3

Sat, 29 Jun 2019 00:00:00 +0000

After a six months hiatus here is a new blogpost.
This saturday I finally found the time to upgrade the configuration of the server that hosts this very website.
Software stack is pretty simple: FreeBSD (version 12.0-p6),nginx (version 1.15.10) and OpenSSL (version 1.1.1a-freebsd).

Install the required software:


$ pkg install nginx-devel py36-certbot

Get a SSL certificate from letsencrypt:


$ certbot-3.6 certonly --standalone -d domain.tld -d www.domain.tld

Certfiles location is /usr/local/etc/letsencrypt/live/<domain.tld>, you might, or might not, want to move them to another directory.

Nginx and XMPP over TLS

Sun, 28 Oct 2018 00:00:00 +0000

XMPP over TLS (formerly XEP-0368) is a clever mechanism that allows users to connect to a XMPP server from networks that restrict outgoing traffic only to specific ports; this block is circumvent by routing XMPP traffic via port TCP 443.
If the server hosts only a XMPP server setting up XMPP over TLS is pretty easy, just instruct the server to listen on port 443.
If the server also runs a webserver which is listening on port 443 things are a bit more complicated; luckily Nginx provides a way to manage XMPP traffic and redirect it to the XMPP server.

Nginx, PHP-FPM, SELinux and sendmail

Fri, 23 Mar 2018 13:54:15 +0000

Since I am a real master at forgiving things I am writing this one down.
PHP mail function relies on sendmail but SELinux by default block webservers from sending emails, the usual error that pop-out is:

cat /var/log/maillog">
---
sendmail[16328]: NOQUEUE: SYSERR(nginx): /etc/mail/sendmail.cf: line 0: cannot open: Permission denied

Allow webservers to send email is as easy as editing the appropriate SELinux boolean:

setsebool -P httpd_can_sendmail 1

Use sestatus to check SELinux booleans:

Nginx, PHP-FPM caching done right

Wed, 22 Apr 2015 23:38:54 +0000

The whole web is full of pseudo guides on how to properly - that is the key word here - configure Nginx to perform caching alongside with PHP-FPM, but every single one of them fails to mention some minor steps resulting in a borked half functioning implementation.
For example, not a single one mention the necessity to edit /etc/php.ini and set session.use_cookies to 0.
Too bad that without doing so caching with WordPress in combination with certain plugins or themes (for example MainWP or Enfold theme) is completely not working; the following headers get added to every HTTP response:

Get rid of SHA-1 – nginx, TLSv1.2, PFS and SHA-2

Tue, 09 Sep 2014 18:02:32 +0000

Everyone who knows me a little bit knows how much I dislike Google but this time we really should thank them for taking a real step toward a more secure web.
They are finally moving away from SHA-1 to the much more secure SHA-2, more info can be found here: http://googleonlinesecurity.blogspot.it/2014/09/gradually-sunsetting-sha-1.html

.:. Setup

CentOS 6.5 x86_64
nginx/1.6.1
OpenSSL 1.0.1e-fips 11 Feb 2013

Nginx developers provide an up to date repository (http://wiki.nginx.org/Install)for CentOS:

nginx and TLS v1.2

Sat, 10 Aug 2013 14:03:39 +0000

Given that SSL and TLS, especially v1.0, suffer from serious security issues (e.g. https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS) I thought it would be a good idea to use the latest and more secure version of it: v1.2.
On CentOS 6.4 the openssl version included is quite old and doesn’t support TLS v1.1 and 1.2.
So, first of all we have to install the latest version 1.0.1e, it can be done compiling from sources or by adding a third party repository; I chose the latter.

WordPress admin, SSL, Apache + nginx

Tue, 30 Jul 2013 15:49:37 +0000

Let’s say we have a WordPress blog and we would like to encrypt our login pages and the whole back-end of the site.
There are many ways to do it, but since I already have a nginx instance configured as reverse proxy running in front of Apache I’ll use it to protect my admin pages and logins.
In this page I’ll not cover Apache’s configuration, which, by the way, is trivial to say the least, so please refer to this other post: Apache + nginx as reverse proxy.
Using the configuration posted in the above’s link as starting point, to add SSL encryption to admin pages we should add a couple more bunch of lines of code.
First of all, we must create our own Certificate Authority and issue a SSL certificate.
Another option is buying a certificate, but I don’t trust CA (certificate forgery anyone?) and I don’t mind having a properly signed certificate for a page I am the only one accessing to.
Follows a brief explanation on how to create a CA and issue a certificate.

Apache + nginx as reverse proxy

Fri, 21 Jun 2013 16:11:13 +0000

One of the things I was planning to do but never did is installing nginx as reverse proxy in front of Apache.
nginx is present in the epel repos for CentOS, so the installation process is just a matter of:

yum install nginx mysql mysql-server phpmyadmin httpd

wget -q -O - http://www.atomicorp.com/installers/atomic | sh

yum install mod_rpaf

mkdir /etc/nginx/v.hosts

vi /etc/nginx/nginx.con

http {
 include v.hosts/*.conf;
 include /etc/nginx/mime.types;
 default_type application/octet-stream;
 
 log_format main '$remote_addr - $remote_user [$time_local] "$request" '
 '$status $body_bytes_sent "$http_referer" '
 '"$http_user_agent" "$http_x_forwarded_for"';
 
 access_log /var/log/nginx/access.log main; 
 
 charset utf-8;
 keepalive_timeout 65;
 server_tokens off;
 sendfile on;
 tcp_nopush on;
 tcp_nodelay off;
 
# Default Server Block to catch undefined host names
# server {
# listen 80;
# server_name _; 
# root /usr/share/nginx/html;
# index index.html index.htm; }
}

/usr/sbin/nginx -t

 server {
 listen 80;
	 server_name nagg.eu;
 
 access_log off;
 error_log off;
 
 location / {
 proxy_pass http://127.0.0.1:8080;
 proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header Host $host;
 proxy_redirect off;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_connect_timeout 90;
 proxy_send_timeout 90;
 proxy_read_timeout 90;
 client_max_body_size 10m;
 client_body_buffer_size 128k;
 proxy_buffer_size 4k;
 proxy_buffers 4 32k;
 proxy_busy_buffers_size 64k;
 }
 }

sudo /usr/sbin/nginx -t
service nginx restart