479
社区成员
发帖
与我相关
我的任务
分享nginx：如何记录TLS错误(如果不支持的密码/协议)
我正在切换到100％https.服务器正在运行nginx libressl.
在开始之前https：100％我有兴趣看到哪些客户端无法再连接到我的网站.例如.因为我不支持SSL3.
我检查了nginx错误和访问日志,但如果我尝试连接SSL3,则没有包含有价值的信息.
我希望看到的内容：例如：
Client [IP]: Connection failed due to protocol/cipher mismatch.
然后,我将能够访问该访问/错误日志,并查看有多少客户端无法再访问我的站点.
这可能吗？
目前的nginx.conf：
user www-data www-data;
pid /run/nginx.pid;
worker_processes auto;
worker_rlimit_nofile 100000;
error_log /var/log/nginx/error.log;
events {
worker_connections 2048;
use epoll;
multi_accept on;
}
http {
server_tokens off;
autoindex off;
charset UTF-8;
include mime.types;
default_type application/octet-stream;
log_format main '$host - $remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
keepalive_timeout 10;
reset_timedout_connection on;
client_body_timeout 10;
send_timeout 10;
client_max_body_size 512k;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
server {
listen 80;
server_name domain.com www.domain.com;
return 301 https://www.domain.com$request_uri;
}
server {
listen 443 ssl spdy;
server_name domain.com;
include conf.d/ssl.conf;
return 301 https://www.domain.com$request_uri;
}
server {
listen 443 ssl spdy;
server_name www.domain.com;
root /var/www/vhosts/domain.com/public_html;
include conf.d/ssl.conf;
default_type text/html;
location / {
return 200 'Hello World!';
}
}
}
conf.d / ssl.conf中：
ssl on;
ssl_dhparam ssl/dhparam4096.pem;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_buffer_size 1400;
spdy_headers_comp 6;
add_header Alternate-Protocol 443:npn-spdy/3;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers "AES256+EECDH:AES256+EDH";
ssl_prefer_server_ciphers on;
ssl_ecdh_curve secp384r1;
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
ssl_certificate ssl/public.crt;
ssl_certificate_key ssl/private.key;
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate ssl/ca-certs.pem;
resolver 8.8.8.8 valid=300s;
resolver_timeout 10s;
...全文
请发表友善的回复…
发表回复
weixin_38086594 2019-09-12
- 打赏
- 举报
在确定SSLv3连接时,我不确定您是否能够设置Nginx来记录详细错误.但您可以将其配置为记录所有SSL或TLS连接,然后您可以解析SSLv3类型连接.为此,您需要将’$ssl_protocol’选项添加到nginx配置文件中的log_format行.
以我的情况为例,我在/etc/nginx/nginx.conf中有以下几行 –
...
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$ssl_protocol '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
...
如果我使用curl建立SSLv3连接 –
daniel@localhost$curl -k --sslv3 https://todo.home.net/login.php
curl: (35) error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure
我在/var/log/nginx/access.log中看到以下几行 –
192.168.10.206 - - [26/Apr/2015:18:21:25 -0700] "GET HTTP/1.0" SSLv3 400 173 "-" "-" "-"
192.168.10.206 - - [26/Apr/2015:18:21:43 -0700] "GET HTTP/1.0 /login.php" SSLv3 400 173 "-" "-" "-"
192.168.10.206 - - [26/Apr/2015:18:22:56 -0700] "-" SSLv3 400 0 "-" "-" "-"
192.168.10.206 - - [26/Apr/2015:18:23:04 -0700] "-" SSLv3 400 0 "-" "-" "-"
如果在Nginx服务器上禁用SSLv3,则客户端会出现错误 –
在服务器端,日志文件将包含协议版本和HTTP代码400,您可以使用该信息来识别使用SSLv3的客户端.
