public_git/bitnami-containers
1
0
Fork 0
mirror of https://github.com/bitnami/containers.git synced 2026-10-17 18:04:55 +02:00
Code Issues Projects Releases Wiki Activity

[bitnami/nginx] Specify ciphers suites and set strong ciphers (#53352)

Browse Source 
* Specify ciphers suites for better control and security

It's better to specify cipher suites to avoid having too many ciphers authorized.

It allow better control of which cipher suites you use.

The cipher have been choosed based on https://english.ncsc.nl/publications/publications/2021/january/19/it-security-guidelines-for-transport-layer-security-2.1

Signed-off-by: samsepi0l <contact@simpleprivacy.fr>

* Remove useless ciphers

Signed-off-by: samsepi0l <contact@simpleprivacy.fr>

* Add "ssl_prefer_server_ciphers" and prioritize ChaCha20 suites with clients that don't have AES-NI

Signed-off-by: samsepi0l <contact@simpleprivacy.fr>

* Update bitnami/nginx/1.25/debian-11/rootfs/opt/bitnami/nginx/conf/nginx.conf

Co-authored-by: Juan José Martos <jotamartos@gmail.com>
Signed-off-by: samsepi0l <contact@samsepi0l.dev>

---------

Signed-off-by: samsepi0l <contact@simpleprivacy.fr>
Signed-off-by: samsepi0l <contact@samsepi0l.dev>
Co-authored-by: samsepi0l <contact@simpleprivacy.fr>
Co-authored-by: Juan José Martos <jotamartos@gmail.com>
This commit is contained in:
samsepi0l
2023-12-21 09:13:15 +01:00
committed by GitHub
co-authored by Juan José Martos samsepi0l
parent 6c1bb22f5e
commit 4a878fac9f
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bitnami/nginx/1.25/debian-11/rootfs/opt/bitnami/nginx/conf/nginx.conf
+1 -1
View File
@@ -34,7 +34,7 @@ http {
gzip_types text/plain text/css application/javascript text/xml application/xml+rss;
keepalive_timeout 65;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
client_max_body_size 80M;
server_tokens off;