Draft CIS Benchmark 1.1.13
Description
Sometimes sensitive web application parameters can be written to NGINX log files.
Rationale
If we imagine sensitive payment information is being sent through NGINX, it may be important to remove such information before it is even logged.
Remediation
Add the following line to the server block in your nginx.conf: set $endpoint $request_uri; if ($endpoint ~ "(.*)\?[^ } log_format combined_no_query '$remote_addr - $remote_user [$time_local] ' '"$request_method $endpoint" $status $body_bytes_sent ' '"$http_referer" "$http_user_agent"'; access_log /var/log/nginx/access.log combined_no_query;
Audit
Check the access\_log from NGINX for any sensitive information.
Description
Sometimes sensitive web application parameters can be written to NGINX log files.
Rationale
If we imagine sensitive payment information is being sent through NGINX, it may be important to remove such information before it is even logged.
Remediation
Add the following line to the
serverblock in yournginx.conf:set $endpoint $request_uri; if ($endpoint ~ "(.*)\?[^ } log_format combined_no_query '$remote_addr - $remote_user [$time_local] ' '"$request_method $endpoint" $status $body_bytes_sent ' '"$http_referer" "$http_user_agent"'; access_log /var/log/nginx/access.log combined_no_query;Audit
Check the
access\_logfrom NGINX for any sensitive information.