diff --git a/host/etc/nginx/nginx.conf b/host/etc/nginx/nginx.conf deleted file mode 100644 index 2281c85b..00000000 --- a/host/etc/nginx/nginx.conf +++ /dev/null @@ -1,97 +0,0 @@ -user www-data; -worker_processes auto; -pid /run/nginx.pid; -load_module /usr/share/nginx/modules/ngx_http_headers_more_filter_module.so; - -events { - worker_connections 768; - # multi_accept on; -} - -http { - - ## - # Basic Settings - ## - - sendfile on; - tcp_nopush on; - tcp_nodelay on; - keepalive_timeout 65; - types_hash_max_size 2048; - # server_tokens off; - - # server_names_hash_bucket_size 64; - # server_name_in_redirect off; - - include /etc/nginx/mime.types; - default_type application/octet-stream; - - ## - # SSL Settings - ## - - ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE - ssl_prefer_server_ciphers on; - - ## - # Logging Settings - ## - - log_format le_json '{ "timestamp": "$time_iso8601", ' - '"src_ip": "$remote_addr", ' - '"remote_user": "$remote_user", ' - '"body_bytes_sent": "$body_bytes_sent", ' - '"request_time": "$request_time", ' - '"status": "$status", ' - '"request": "$request", ' - '"request_method": "$request_method", ' - '"http_referrer": "$http_referer", ' - '"http_user_agent": "$http_user_agent" }'; - - access_log /var/log/nginx/access.log le_json; - error_log /var/log/nginx/error.log; - - ## - # Gzip Settings - ## - - gzip on; - gzip_disable "msie6"; - - # gzip_vary on; - # gzip_proxied any; - # gzip_comp_level 6; - # gzip_buffers 16 8k; - # gzip_http_version 1.1; - # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript; - - ## - # Virtual Host Configs - ## - - include /etc/nginx/conf.d/*.conf; - include /etc/nginx/sites-enabled/*; -} - - -#mail { -# # See sample authentication script at: -# # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript -# -# # auth_http localhost/auth.php; -# # pop3_capabilities "TOP" "USER"; -# # imap_capabilities "IMAP4rev1" "UIDPLUS"; -# -# server { -# listen localhost:110; -# protocol pop3; -# proxy on; -# } -# -# server { -# listen localhost:143; -# protocol imap; -# proxy on; -# } -#} diff --git a/host/etc/nginx/ssl/dhparam4096.pem b/host/etc/nginx/ssl/dhparam4096.pem deleted file mode 100644 index 78cbf6d7..00000000 --- a/host/etc/nginx/ssl/dhparam4096.pem +++ /dev/null @@ -1,13 +0,0 @@ ------BEGIN DH PARAMETERS----- -MIICCAKCAgEAiHmfakVLOStSULBdaTbZY/zeFyEeQ19GY9Z5CJg06dIIgIzhxk9L -4xsQdQk8giKOjP6SfX0ZgF5CYaurQ3ljYlP0UlAQQo9+fEErbqj3hCzAxtIpd6Yj -SV6zFdnSjwxWuKAPPywiQNljnHH+Y1KBdbl5VQ9gC3ehtaLo1A4y8q96f6fC5rGU -nfgw4lTxLvPD7NwaOdFTCyK8tTxvUGNJIvf7805IxZ0BvAiBuVaXStaMcqf5BHLP -fYpvIiVaCrtto4elu18nL0tf2CN5n9ai4hlr0nPmNrE/Zrrur78Re5F4Ien9kr4d -xabXvVJJQa9j2NdQO7vk7Cz/dAIiqt/1XKFhll4TTYBqrFVXIwF+FNx636zyOjcO -nlZk/V+IL/UTPnZOv2PGt5+WetvJJubi6B9XgOgVLduI07woAp5qnRJJt6fJW1aA -M86By6WLy5P31Py6eFj8nYgj1V703XgQ5lESKYpeVgqA0bh7daNzOCoGQvvUKlTP -RTu6fs7clw5ta4yYUyvuIKTngH5yGBNdTuP0GWo6Y+Dy1BctVwl2xSw+FhYeuIf/ -EB2A3129H59HhbWyNH337+1dfntHfQRXBsT0YSyDxPurI5/FNGcmw+GZEYk4BB8j -g7TwH3GBjbKnjnr7SnhanqmWgybgQw6oR9gDC399eR4LiOk9sbxpX1MCAQI= ------END DH PARAMETERS----- diff --git a/host/etc/nginx/ssl/gen-cert.sh b/host/etc/nginx/ssl/gen-cert.sh deleted file mode 100644 index 388e51ee..00000000 --- a/host/etc/nginx/ssl/gen-cert.sh +++ /dev/null @@ -1,12 +0,0 @@ -#!/bin/bash - -# Got root? -myWHOAMI=$(whoami) -if [ "$myWHOAMI" != "root" ] - then - echo "Need to run as root ..." - exit -fi - -openssl req -nodes -x509 -sha512 -newkey rsa:8192 -keyout "nginx.key" -out "nginx.crt" -days 3650 - diff --git a/host/etc/nginx/ssl/gen-dhparam.sh b/host/etc/nginx/ssl/gen-dhparam.sh deleted file mode 100644 index b4af43e6..00000000 --- a/host/etc/nginx/ssl/gen-dhparam.sh +++ /dev/null @@ -1,16 +0,0 @@ -#!/bin/bash - -# Got root? -myWHOAMI=$(whoami) -if [ "$myWHOAMI" != "root" ] - then - echo "Need to run as root ..." - exit -fi - -if [ "$1" = "2048" ] || [ "$1" = "4096" ] || [ "$1" = "8192" ] - then - openssl dhparam -outform PEM -out dhparam$1.pem $1 - else - echo "Usage: ./gen-dhparam [2048, 4096, 8192]..." -fi diff --git a/host/etc/nginx/tpotweb.conf b/host/etc/nginx/tpotweb.conf deleted file mode 100644 index 00eb95ee..00000000 --- a/host/etc/nginx/tpotweb.conf +++ /dev/null @@ -1,155 +0,0 @@ -############################################ -### NGINX T-Pot configuration file by mo ### -############################################ - -################################### -### Allow for 60 reloads per minute -################################### -limit_req_zone $binary_remote_addr zone=base:1m rate=1r/s; - -server { - - ######################### - ### Basic server settings - ######################### - listen 64297 ssl http2; - index tpotweb.html; - ssl_protocols TLSv1.2; - server_name example.com; - error_page 300 301 302 400 401 402 403 404 500 501 502 503 504 /error.html; - - - ############################################## - ### Remove version number add different header - ############################################## - server_tokens off; - more_set_headers 'Server: apache'; - - - ############################################## - ### SSL settings and Cipher Suites - ############################################## - ssl_certificate /etc/nginx/ssl/nginx.crt; - ssl_certificate_key /etc/nginx/ssl/nginx.key; - - ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:!DHE:!SHA:!SHA256'; - ssl_ecdh_curve secp384r1; - ssl_dhparam /etc/nginx/ssl/dhparam4096.pem; - - ssl_prefer_server_ciphers on; - ssl_session_cache shared:SSL:10m; - - - #################################### - ### OWASP recommendations / settings - #################################### - - ### Size Limits & Buffer Overflows - ### the size may be configured based on the needs. - client_body_buffer_size 100K; - client_header_buffer_size 1k; - client_max_body_size 100k; - large_client_header_buffers 2 1k; - - ### Mitigate Slow HHTP DoS Attack - ### Timeouts definition ## - client_body_timeout 10; - client_header_timeout 10; - keepalive_timeout 5 5; - send_timeout 10; - - ### X-Frame-Options is to prevent from clickJacking attack - add_header X-Frame-Options SAMEORIGIN; - - ### disable content-type sniffing on some browsers. - add_header X-Content-Type-Options nosniff; - - ### This header enables the Cross-site scripting (XSS) filter - add_header X-XSS-Protection "1; mode=block"; - - ### This will enforce HTTP browsing into HTTPS and avoid ssl stripping attack - add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;"; - - - ################################## - ### Restrict access and basic auth - ################################## - - # satisfy all; - satisfy any; - - # allow 10.0.0.0/8; - # allow 172.16.0.0/12; - # allow 192.168.0.0/16; - allow 127.0.0.1; - allow ::1; - deny all; - - auth_basic "closed site"; - auth_basic_user_file /etc/nginx/nginxpasswd; - - - ############################## - ### Limit brute-force attempts - ############################## - location = / { - limit_req zone=base burst=1 nodelay; - } - - - ################# - ### Proxied sites - ################# - - ### Kibana - location /kibana/ { - proxy_pass http://localhost:64296; - rewrite /kibana/(.*)$ /$1 break; - } - - ### ES - location /es/ { - proxy_pass http://localhost:64298/; - rewrite /es/(.*)$ /$1 break; - } - - ### head standalone - location /myhead/ { - proxy_pass http://localhost:64302/; - rewrite /myhead/(.*)$ /$1 break; - } - - ### portainer - location /ui { - proxy_pass http://127.0.0.1:64299; - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection $http_connection; - proxy_set_header Host $host; - proxy_redirect off; - rewrite /ui/(.*)$ /$1 break; - } - ### web tty - location /wetty { - proxy_pass http://127.0.0.1:64300/wetty; - } - - ### netdata - location /netdata/ { - proxy_pass http://localhost:64301; - rewrite /netdata/(.*)$ /$1 break; - } - - ### spiderfoot - location /spiderfoot { - proxy_pass http://127.0.0.1:64303; - } - - location /static { - proxy_pass http://127.0.0.1:64303/spiderfoot/static; - } - - location /scanviz { - proxy_pass http://127.0.0.1:64303/spiderfoot/scanviz; - } -} diff --git a/host/usr/share/nginx/html/error.html b/host/usr/share/nginx/html/error.html deleted file mode 100644 index e69de29b..00000000 diff --git a/host/usr/share/nginx/html/favicon.ico b/host/usr/share/nginx/html/favicon.ico deleted file mode 100644 index a40c2372..00000000 Binary files a/host/usr/share/nginx/html/favicon.ico and /dev/null differ diff --git a/host/usr/share/nginx/html/navbar.html b/host/usr/share/nginx/html/navbar.html deleted file mode 100644 index d3b311a8..00000000 --- a/host/usr/share/nginx/html/navbar.html +++ /dev/null @@ -1,21 +0,0 @@ - - - - - - T-Pot - - - - -
- Home - Kibana - ES Head - Netdata - Spiderfoot - Portainer - WebTTY -
- - diff --git a/host/usr/share/nginx/html/style.css b/host/usr/share/nginx/html/style.css deleted file mode 100644 index 2696a613..00000000 --- a/host/usr/share/nginx/html/style.css +++ /dev/null @@ -1,17 +0,0 @@ -.btn { - -webkit-border-radius: 0; - -moz-border-radius: 0; - border-radius: 0px; - font-family: Arial; - color: #ffffff; - font-size: 12px; - background: #E20074; - padding: 2px 30px 2px 30px; - text-decoration: none; -} - -.btn:hover { - background: #c2c2c2; - text-decoration: none; -} - diff --git a/host/usr/share/nginx/html/tpotweb.html b/host/usr/share/nginx/html/tpotweb.html deleted file mode 100644 index 6f3a0146..00000000 --- a/host/usr/share/nginx/html/tpotweb.html +++ /dev/null @@ -1,15 +0,0 @@ - - - - - - T-Pot - - - - - - - - -