Draft CIS Benchmark 1.1.10
Description
By default NGINX will happily tell a user what version of NGINX is in use. This is valuable information to an attacker, and should be turned off by making use of the server\_tokens directive.
Rationale
Potential attackers may check if your version of NGINX contains known vulnerabilities. Hiding the version will slow down and mitigate potential attackers.
Remediation
To disable the server\_tokens directive, set if to off inside a server block in your nginx.conf: server { ... server_tokens off; ... }
Audit
In the NGINX configuration file nginx.conf ensure the server\_tokens directive is set to off. You can also check a 404 page provided by NGINX and see if it displays a version number.
Description
By default NGINX will happily tell a user what version of NGINX is in use. This is valuable information to an attacker, and should be turned off by making use of the
server\_tokensdirective.Rationale
Potential attackers may check if your version of NGINX contains known vulnerabilities. Hiding the version will slow down and mitigate potential attackers.
Remediation
To disable the
server\_tokensdirective, set if tooffinside aserverblock in yournginx.conf:server { ... server_tokens off; ... }Audit
In the NGINX configuration file
nginx.confensure theserver\_tokensdirective is set tooff. You can also check a 404 page provided by NGINX and see if it displays a version number.