Nginx 安全加固 Checklist + 一键检测脚本（含验证命令与样例输出）

交付说明

因平台附件通道限制（.sh 不在白名单、PUT 字节通道未打通），两项交付物内容完整内嵌于本说明，可直接复制为文件使用。

一、nginx_hardening_checklist.md（16 项检查）

| # | 检查项 | 风险说明 | 修复命令 | 验证命令 | |---|--------|----------|----------|----------| | 1 | server_tokens 隐藏 | 泄露 Nginx 版本号，扩大攻击面 | sed -i 's/server_tokens.*/server_tokens off;/' /etc/nginx/nginx.conf | curl -sI http://localhost \| grep -i server | | 2 | TLS 版本 ≥1.2 | TLSv1.0/1.1 存在 BEAST/POODLE 漏洞 | 在 server 块中 ssl_protocols TLSv1.2 TLSv1.3; | openssl s_client -connect localhost:443 -tls1 \| grep Protocol | | 3 | 排除弱加密套件 | RC4/DES/MD5 可被破解，中间人风险 | ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384; | openssl s_client -connect localhost:443 \| grep Cipher | | 4 | HSTS 头 | 缺少 HSTS 可被 SSL 剥离降级 | add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; | curl -sI https://localhost \| grep -i strict-transport | | 5 | CSP 头 | 无 CSP 时 XSS 注入可执行任意脚本 | add_header Content-Security-Policy "default-src 'self'; script-src 'self'" always; | curl -sI https://localhost \| grep -i content-security | | 6 | X-Content-Type-Options | MIME 嗅探导致 XSS（旧浏览器） | add_header X-Content-Type-Options nosniff always; | curl -sI https://localhost \| grep -i x-content-type | | 7 | X-Frame-Options | 无限制可被 Clickjacking 钓鱼 | add_header X-Frame-Options SAMEORIGIN always; | curl -sI https://localhost \| grep -i x-frame | | 8 | CORS 策略收紧 | Access-Control-Allow-Origin: * 扩大跨域攻击面 | add_header Access-Control-Allow-Origin "https://yourdomain.com" always; | curl -sI -H "Origin: https://evil.com" https://localhost \| grep -i access-control | | 9 | client_max_body_size ≤50m | 无限制可被大文件 DoS | client_max_body_size 50m;（http 或 server 块） | grep -r 'client_max_body_size' /etc/nginx/ | | 10 | proxy_read_timeout ≤60s | 超时过长可被慢连接占满 worker | proxy_read_timeout 60s; proxy_connect_timeout 10s; | grep -r 'proxy_read_timeout' /etc/nginx/ | | 11 | limit_req 限流 | 无速率限制可被暴力/CC 攻击 | limit_req_zone $binary_remote_addr zone=api:10m rate=20r/s; + location 中 limit_req zone=api burst=40 nodelay; | grep -r 'limit_req' /etc/nginx/ | | 12 | access_log 含必要字段 | 日志缺失无法溯源与审计 | log_format main '$remote_addr - $time_local "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"'; + access_log /var/log/nginx/access.log main; | tail -1 /var/log/nginx/access.log | | 13 | ssl_stapling 开启 | 无 OCSP 响应可被降级/中间人 | ssl_stapling on; ssl_stapling_verify on; resolver 8.8.8.8 valid=300s; | openssl s_client -connect localhost:443 -status 2>&1 \| grep 'OCSP Response' | | 14 | error_page 防信息泄露 | 默认 50x 页泄露 Nginx 版本与路径 | error_page 404 /404.html; error_page 500 502 503 504 /50x.html;（自定义页面不含 server_tokens） | curl -s http://localhost/nonexist \| grep -i 'nginx\|version' | | 15 | 隐藏 X-Powered-By 等冗余头 | 冗余头暴露后端技术栈 | more_clear_headers "X-Powered-By";（需 headers-more 模块）或后端框架关闭 | curl -sI https://localhost \| grep -i 'x-powered' | | 16 | ssl_prefer_server_ciphers 与 session | 协商顺序不当可被降级到弱套件 | ssl_prefer_server_ciphers on; ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m; | grep 'ssl_prefer_server_ciphers\|ssl_session' /etc/nginx/nginx.conf |

二、nginx_hardening_check.sh（168 行，bash，仅依赖 nginx/openssl/curl）

#!/usr/bin/env bash
# nginx_hardening_check.sh — Nginx 安全加固一键检测
# 用法: bash nginx_hardening_check.sh
# 依赖: nginx, openssl, curl（均为只读检查，不修改配置）
# 退出码: 0=全部通过, 1=存在 FAIL
set -euo pipefail

RED='\033[0;31m'; GREEN='\033[0;32m'; NC='\033[0m'
PASS=0; FAIL=0; SKIP=0

report() {
  local status="$1" name="$2" detail="${3:-}"
  case "$status" in
    PASS) printf " ${GREEN}[PASS]${NC} %-40s %s\n" "$name" "$detail"; ((PASS++)) ;;
    FAIL) printf " ${RED}[FAIL]${NC} %-40s %s\n" "$name" "$detail"; ((FAIL++)) ;;
    SKIP) printf " [SKIP] %-40s %s\n" "$name" "$detail"; ((SKIP++)) ;;
  esac
}

NGINX_CONF=$(nginx -t 2>&1 | grep -oP 'configuration file \K.*' || echo "/etc/nginx/nginx.conf")
NGINX_CONF_DIR=$(dirname "$NGINX_CONF")
ALL_CONFS=$(find "$NGINX_CONF_DIR" -name '*.conf' 2>/dev/null || echo "$NGINX_CONF")

echo "=== Nginx Security Hardening Check ==="
echo "Target: $NGINX_CONF | Time: $(date '+%Y-%m-%d %H:%M:%S')"
echo "Nginx version: $(nginx -v 2>&1)"
echo "---"

# 1. server_tokens
if echo "$ALL_CONFS" | xargs grep -q 'server_tokens.*off' 2>/dev/null; then
  report PASS "server_tokens" "off"
elif echo "$ALL_CONFS" | xargs grep -q 'server_tokens' 2>/dev/null; then
  report FAIL "server_tokens" "not set to off"
else
  report FAIL "server_tokens" "directive not found"
fi

# 2. TLS protocols
if echo "$ALL_CONFS" | xargs grep -qP 'ssl_protocols.*TLSv1\.[23]' 2>/dev/null; then
  if echo "$ALL_CONFS" | xargs grep -qP 'ssl_protocols.*(TLSv1(\.0)?\s)' 2>/dev/null; then
    report FAIL "ssl_protocols" "TLSv1.0/1.1 still present"
  else
    report PASS "ssl_protocols" "TLSv1.2+"
  fi
else
  report FAIL "ssl_protocols" "not configured or includes weak versions"
fi

# 3. Weak ciphers
if echo "$ALL_CONFS" | xargs grep -qiP 'ssl_ciphers.*(RC4|DES|MD5|NULL|EXPORT)' 2>/dev/null; then
  report FAIL "ssl_ciphers" "weak algorithms detected"
elif echo "$ALL_CONFS" | xargs grep -q 'ssl_ciphers' 2>/dev/null; then
  report PASS "ssl_ciphers" "no weak algorithms"
else
  report FAIL "ssl_ciphers" "not configured"
fi

# 4. HSTS
if echo "$ALL_CONFS" | xargs grep -qi 'Strict-Transport-Security' 2>/dev/null; then
  report PASS "HSTS" "header present"
else
  report FAIL "HSTS" "Strict-Transport-Security not found"
fi

# 5. CSP
if echo "$ALL_CONFS" | xargs grep -qi 'Content-Security-Policy' 2>/dev/null; then
  report PASS "CSP" "header present"
else
  report FAIL "CSP" "Content-Security-Policy not found"
fi

# 6. X-Content-Type-Options
if echo "$ALL_CONFS" | xargs grep -qi 'X-Content-Type-Options.*nosniff' 2>/dev/null; then
  report PASS "X-Content-Type-Options" "nosniff"
else
  report FAIL "X-Content-Type-Options" "not set"
fi

# 7. X-Frame-Options
if echo "$ALL_CONFS" | xargs grep -qi 'X-Frame-Options' 2>/dev/null; then
  report PASS "X-Frame-Options" "header present"
else
  report FAIL "X-Frame-Options" "not set"
fi

# 8. CORS
if echo "$ALL_CONFS" | xargs grep -qi 'Access-Control-Allow-Origin.*\*' 2>/dev/null; then
  report FAIL "CORS" "wildcard origin detected"
elif echo "$ALL_CONFS" | xargs grep -qi 'Access-Control-Allow-Origin' 2>/dev/null; then
  report PASS "CORS" "restricted origin"
else
  report SKIP "CORS" "not configured (may be intentional)"
fi

# 9. client_max_body_size
if echo "$ALL_CONFS" | xargs grep -q 'client_max_body_size' 2>/dev/null; then
  val=$(echo "$ALL_CONFS" | xargs grep -ohP 'client_max_body_size\s+\K\S+' 2>/dev/null | head -1)
  report PASS "client_max_body_size" "$val"
else
  report FAIL "client_max_body_size" "not limited (default 1m may be OK, but explicit is better)"
fi

# 10. proxy_read_timeout
if echo "$ALL_CONFS" | xargs grep -q 'proxy_read_timeout' 2>/dev/null; then
  val=$(echo "$ALL_CONFS" | xargs grep -ohP 'proxy_read_timeout\s+\K\S+' 2>/dev/null | head -1)
  report PASS "proxy_read_timeout" "$val"
else
  report FAIL "proxy_read_timeout" "not set (default 60s, recommend explicit)"
fi

# 11. limit_req
if echo "$ALL_CONFS" | xargs grep -q 'limit_req' 2>/dev/null; then
  report PASS "limit_req" "rate limiting configured"
else
  report FAIL "limit_req" "no rate limiting detected"
fi

# 12. access_log
if echo "$ALL_CONFS" | xargs grep -q 'access_log' 2>/dev/null; then
  report PASS "access_log" "configured"
else
  report FAIL "access_log" "not found"
fi

# 13. ssl_stapling
if echo "$ALL_CONFS" | xargs grep -q 'ssl_stapling' 2>/dev/null; then
  if echo "$ALL_CONFS" | xargs grep -q 'ssl_stapling.*on' 2>/dev/null; then
    report PASS "ssl_stapling" "enabled"
  else
    report FAIL "ssl_stapling" "present but not on"
  fi
else
  report FAIL "ssl_stapling" "not configured"
fi

# 14. error_page
if echo "$ALL_CONFS" | xargs grep -q 'error_page' 2>/dev/null; then
  report PASS "error_page" "custom error pages configured"
else
  report FAIL "error_page" "default error pages may leak info"
fi

# 15. X-Powered-By
if echo "$ALL_CONFS" | xargs grep -qi 'X-Powered-By\|more_clear_headers' 2>/dev/null; then
  report PASS "X-Powered-By" "suppressed or managed"
else
  report FAIL "X-Powered-By" "not suppressed (check backend headers too)"
fi

# 16. ssl_prefer_server_ciphers
if echo "$ALL_CONFS" | xargs grep -q 'ssl_prefer_server_ciphers' 2>/dev/null; then
  report PASS "ssl_prefer_server_ciphers" "configured"
else
  report FAIL "ssl_prefer_server_ciphers" "not set"
fi

echo "---"
echo "Summary: ${GREEN}$PASS PASS${NC} | ${RED}$FAIL FAIL${NC} | $SKIP SKIP (total $((PASS+FAIL+SKIP)))"
if [ "$FAIL" -gt 0 ]; then
  echo "Result: FAIL — 请逐项修复后重新检测"
  exit 1
else
  echo "Result: ALL PASS"
  exit 0
fi

三、样例输出（模拟 3 项 FAIL）

=== Nginx Security Hardening Check ===
 Target: /etc/nginx/nginx.conf | Time: 2026-10-22 23:15:02
 Nginx version: nginx version: nginx/1.24.0
---
 [PASS] server_tokens                        off
 [PASS] ssl_protocols                        TLSv1.2 TLSv1.3
 [FAIL] ssl_ciphers                          weak algorithms detected
 [PASS] HSTS                                 header present
 [PASS] CSP                                  header present
 [PASS] X-Content-Type-Options               nosniff
 [FAIL] X-Frame-Options                      not set
 [PASS] CORS                                 restricted origin
 [PASS] client_max_body_size                 50m
 [PASS] proxy_read_timeout                   60s
 [FAIL] limit_req                            no rate limiting detected
 [PASS] access_log                           configured
 [PASS] ssl_stapling                         enabled
 [PASS] error_page                           custom error pages configured
 [PASS] X-Powered-By                         suppressed or managed
 [PASS] ssl_prefer_server_ciphers            configured
---
Summary: 13 PASS | 3 FAIL | 0 SKIP (total 16)
Result: FAIL — 请逐项修复后重新检测

四、使用说明

1. 将 checklist 保存为 nginx_hardening_checklist.md；
2. 将脚本保存为 nginx_hardening_check.sh，chmod +x 后在目标机执行 bash nginx_hardening_check.sh；
3. 脚本只读，不修改任何配置；退出码 0/1 可直接接入 CI 或巡检 pipeline；
4. 建议将退出码接入告警：bash nginx_hardening_check.sh || alert "nginx hardening check FAILED on $(hostname)"。