Support for Nagios products and services
https://support.nagios.com/forum/
-- https://github.com/NagiosEnterprises/na ... issues/809The issue isn't with our CSRF protection, it's instead due to the Core CGIs using HTTP by default, so that someone sniffing the requests can see CSRF tokens in plaintext.
Yes it does. It's on page 7:hbouma wrote:however, nothing in this document appears to be turning off non-SSL traffic.
That last rewriterule forces traffic to use HTTPS.Add the following lines to the end of the file (press SHIFT + G):
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule nagiosxi/api/v1/(.*)$ /usr/local/nagiosxi/html/api/v1/index.php?request=$1 [QSA,NC,L]
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
</IfModule>
Code: Select all
Header always set Strict-Transport-Security "max-age=63072000"Code: Select all
# generated 2021-02-16, Mozilla Guideline v5.6, Apache 2.4.41, OpenSSL 1.1.1d, intermediate configuration
# https://ssl-config.mozilla.org/#server=apache&version=2.4.41&config=intermediate&openssl=1.1.1d&guideline=5.6
# this configuration requires mod_ssl, mod_socache_shmcb, mod_rewrite, and mod_headers
<VirtualHost *:80>
RewriteEngine On
RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L]
</VirtualHost>
<VirtualHost *:443>
SSLEngine on
# curl https://ssl-config.mozilla.org/ffdhe2048.txt >> /path/to/signed_cert_and_intermediate_certs_and_dhparams
SSLCertificateFile /path/to/signed_cert_and_intermediate_certs_and_dhparams
SSLCertificateKeyFile /path/to/private_key
# enable HTTP/2, if available
Protocols h2 http/1.1
# HTTP Strict Transport Security (mod_headers is required) (63072000 seconds)
Header always set Strict-Transport-Security "max-age=63072000"
</VirtualHost>
# intermediate configuration
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
SSLHonorCipherOrder off
SSLSessionTickets off
SSLUseStapling On
SSLStaplingCache "shmcb:logs/ssl_stapling(32768)"Indeed, our documents change as new practices come out, and the software changes.hbouma wrote:Is this a new addition to the document? It doesn't seem to have been there when we setup our servers in 2018.
This isn't recommended. It will cause browser requests to fail if someone loads up the non-HTTPS site. If someone loads up the browser and simply types in the hostname, it'll return an error instead of redirecting them to HTTPS.hbouma wrote:I also found that we had to remove the http (80) firewall service leaving only the https (443) service as the lines provided still allowed communication to Apache, only giving a redirect response.