Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Filtering the webserver information in the nginx default error responses #2539

Merged
merged 1 commit into from
Jun 22, 2021
Merged

Filtering the webserver information in the nginx default error responses #2539

merged 1 commit into from
Jun 22, 2021

Conversation

jashaik
Copy link
Contributor

@jashaik jashaik commented Jun 16, 2021 •
edited
Loading

Signed-off-by: jan shahid shaik jashaik@progress.com

Description

The internal server software used by the chef-server is revealed by the web server(nginx/openresty) in the default error reponses.

Issues Resolved

https://app.zenhub.com/workspaces/chef-infra-server-team-5fc64867d45ca500173dbbc7/issues/chef/customer-bugs/373

Solved -

  • openresty version/openresty server info in all the success/opscode-erchef generated responses - Solved by 'server_tokens off;' nginx tag
  • openresty verison info in all the default nginx error responses - Solved by 'server_tokens off;' nginx tag
  • openresty server name in the default nginx error reponses - solved by the 'body_filter_by_lua' directive(PR Filtering the webserver information in the nginx default error responses #2539 ).

Check List

@jashaik jashaik requested review from a team as code owners June 16, 2021 11:33
@netlify
Copy link

netlify bot commented Jun 16, 2021 •
edited
Loading

👷 Deploy Preview for chef-server processing.

🔨 Explore the source changes: c9582a7

🔍 Inspect the deploy log: https://app.netlify.com/sites/chef-server/deploys/60d2355e7d891a0007965db0

@jashaik
Copy link
Contributor Author

jashaik commented Jun 16, 2021 •
edited
Loading

Pipeline Information -
Adhoc -https://buildkite.com/chef/chef-chef-server-master-omnibus-adhoc/builds/2797#fbd74ef2-cb2a-459b-ab8a-a73234706093
Umbrella - https://buildkite.com/chef/chef-umbrella-master-chef-server/builds/503#c2bcb14d-0699-4129-a6f8-34441e273c0a

@jashaik jashaik force-pushed the shahid/nginx-security-issue branch from e58984a to 074276a Compare June 16, 2021 11:44
@jashaik jashaik changed the title Filtering the webserver information in the nginx default error responses WIP - Filtering the webserver information in the nginx default error responses Jun 16, 2021
@jashaik jashaik force-pushed the shahid/nginx-security-issue branch 2 times, most recently from 729249d to 8f25de0 Compare June 17, 2021 06:46
@jashaik jashaik changed the title WIP - Filtering the webserver information in the nginx default error responses Filtering the webserver information in the nginx default error responses Jun 17, 2021
@PrajaktaPurohit
Copy link
Contributor

PrajaktaPurohit commented Jun 21, 2021 •
edited
Loading

current output

root@api:~# curl -i -X TRACE -k https://api.chef-server.dev/_status
HTTP/1.1 301 Moved Permanently
Date: Mon, 21 Jun 2021 19:00:53 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Location: https://api.chef-server.dev/_status

<html>
<head><title>301 Moved Permanently</title></head>
<body>
<center><h1>301 Moved Permanently</h1></center>
<hr><center>chef</center>
</body>
</html>

with empty replace string

root@api:~# curl -i -X TRACE -k http://api.chef-server.dev/_status
HTTP/1.1 301 Moved Permanently
Date: Mon, 21 Jun 2021 19:00:59 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Location: https://api.chef-server.dev/_status

<html>
<head><title>301 Moved Permanently</title></head>
<body>
<center><h1>301 Moved Permanently</h1></center>
<hr><center></center>
</body>
</html>

PrajaktaPurohit
PrajaktaPurohit approved these changes Jun 21, 2021
View reviewed changes
Copy link
Contributor

@PrajaktaPurohit PrajaktaPurohit left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nicely done! Left some suggestions. https://github.com/chef/chef-server/blob/master/oc-chef-pedant/spec/api/header_spec.rb might be a good place to add some tests for this.

@jashaik jashaik force-pushed the shahid/nginx-security-issue branch 6 times, most recently from a420357 to 64413e2 Compare June 22, 2021 17:18
@PrajaktaPurohit PrajaktaPurohit mentioned this pull request Jun 22, 2021
Merged
10 tasks
@jashaik jashaik force-pushed the shahid/nginx-security-issue branch 2 times, most recently from b78333b to bfae3dc Compare June 22, 2021 18:04
@jashaik @PrajaktaPurohit
Filtering the webserver information in the nginx default error responses
c9582a7 
Signed-off-by: jan shahid shaik <jashaik@progress.com>
@PrajaktaPurohit PrajaktaPurohit merged commit 4a8743d into master Jun 22, 2021
@PrajaktaPurohit PrajaktaPurohit deleted the shahid/nginx-security-issue branch June 22, 2021 19:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@PrajaktaPurohit PrajaktaPurohit PrajaktaPurohit approved these changes

@marcparadise marcparadise marcparadise approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@jashaik @PrajaktaPurohit @marcparadise