Lemmy.world is exposing the NGINX version
I am not sure if this is the right sub, but yesterday I was having some issues with login with my user and was getting 403 error if I am not wrong and noticed that the NGINX version is exposed, which is a bad practice.
So if someone from the admins of Lemmy.world see this message, maybe they can change the NGINX config and hide the version flag by setting "server_tokens off;".
175
Comments17
Thanks for the tip, I changed it.
This really should be the default behavior, IMO.
My pet theory is that NGINX was designed by a pen-tester who realized that all they needed to do to make the majority of SMBs expose their web servers to the internet was outperform Apache
They're not THAT bad...
Besides, the distro packager could also do something about it.
They likely won't see this unless you tag them or cross post to ![email protected]
That said, I suspect the version is what's standard in the docker image, so hidden or not, it's easy to discover.
Edit: on the other hand, does the latest nginx get pulled at time of creation?
It depends on how you have your
docker composefile set up. If you pin the version, no, it's never going to get updated unless a new version with that exact tag is released. If you omit the tag, it's going to default to whatever is tagged aslatestin the image repository, and that's only going to actually update the image when you either manually pull the image or relaunch thecomposestack.If you want it to auto-update without relaunching the stack or manually pulling the latest image, you'd have to set up something like Watchtower and have it monitor that container.
Ugh, I didn't know, thanks for tagging them.
I didn't tag anyone--its a link to the support community. If you don't get any traction in a day or so, you can look at some of the names of admins posting in there and tag them with "@[email protected]"
@[email protected] did it work? Is this in your inbox?
Huh, it sure did. Neat!
@JackbyDev @s38b35M5 @TheSpookiestUser completely off topic Jackby: your avatar kicks ass!
Does this actually work to notify someone on Lemmy?
@user@instanceis how you're supposed to mention a user. There is a space in the inbox for mentions so I assume it works.I clicked on the link but I can't contact or write them anything.
Might as well hide the version, but if someone is going to try an exploit, they'll just try it and see whether it works.
Yeah, this post is giving me "security through obscurity" vibes.
Obscuring version numbers is best practice. Trying exploits isn't always trivial and by knowing the exact version number of the software it can be made a whole lot easier. Good post by OP though I do think it should've been a DM to Ruud.