How to analyze Nginx configuration files for security misconfiguration on Linux or Unix

Posted on in Categories , , , , , , , , last updated May 14, 2017

How do I install Gixy for Nginx configuration static analyzer on GNU/Linux operating system to to prevent security misconfiguration and automate flaw detection?

From the project page:

Gixy is a tool to analyze Nginx configuration. The main goal of Gixy is to prevent security misconfiguration and automate flaw detection. Currently supported Python versions are 2.7 and 3.5+. Right now Gixy can find:

  1. [ssrf] Server Side Request Forgery
  2. [http_splitting] HTTP Splitting
  3. [origins] Problems with referrer/origin validation
  4. [add_header_redefinition] Redefining of response headers by “add_header” directive
  5. [host_spoofing] Request’s Host header forgery
  6. [valid_referers] none in valid_referers
  7. [add_header_multiline] Multiline response headers

Installation

Type the following command:
$ pip install gixy
Sample outputs:

Fig.01: pip install gixy
Fig.01: pip install gixy

How do I use Gixy?

The syntax is:
$ gixy /etc/nginx/nginx.conf
$ gixy [options] /etc/nginx/nginx.conf

Here is the output from my own site:

Fig.02: gixy in action
Fig.02: gixy in action

Options

To see gixy option type:
$ gixy -h
Sample outputs:


positional arguments:
  nginx.conf            Path to nginx.conf, e.g. /etc/nginx/nginx.conf

optional arguments:
  -h, --help            show this help message and exit
  -c CONFIG_FILE, --config CONFIG_FILE
                        config file path
  --write-config CONFIG_OUTPUT_PATH
                        takes the current command line args and writes them
                        out to a config file at the given path, then exits
  -v, --version         show program's version number and exit
  -l, --level           Report issues of a given severity level or higher (-l
                        for LOW, -ll for MEDIUM, -lll for HIGH)
  -f {text,json,console}, --format {text,json,console}
                        Specify output format
  -o OUTPUT_FILE, --output OUTPUT_FILE
                        Write report to file
  -d, --debug           Turn on debug mode
  --tests TESTS         Comma-separated list of tests to run
  --skips SKIPS         Comma-separated list of tests to skip
  --disable-includes    Disable "include" directive processing

plugins options:
  --origins-domains domains
                        Default: *
  --origins-https-only https_only
                        Default: False
  --add-header-redefinition-headers headers
                        Default: x-frame-options,x-xss-protection,content-
                        security-policy,x-content-type-options,cache-control


available plugins:
	add_header_multiline
	http_splitting
	host_spoofing
	origins
	add_header_redefinition
	valid_referers
	ssrf

For more info see https://github.com/yandex/gixy.

Posted by: Vivek Gite

The author is the creator of nixCraft and a seasoned sysadmin and a trainer for the Linux operating system/Unix shell scripting. He has worked with global clients and in various industries, including IT, education, defense and space research, and the nonprofit sector. Follow him on Twitter, Facebook, Google+.

Leave a Comment