☰

尽管已配置 nginx 可以发送 HSTS 标头，但 nginx 无法发送 HSTS 标头

tag-icon • tag-icon nginx ssl hsts
尽管已配置 nginx 可以发送 HSTS 标头，但 nginx 无法发送 HSTS 标头

我正在使用 nginx 和 letsencrypt 为自己建立一个网站，并且我想设置 HSTS 预加载以增加安全性，但是当我使用多个不同的扫描仪检查 url 时，HSTS 标头不会被发送。

这是服务器配置中的相关块：

 server {

    root /var/www/html/pyroballpcbs;
    index index.php index.html index.htm;

    server_name pyroballpcbs.com www.pyroballpcbs.com;
    server_tokens off;

    client_max_body_size 20M;

    location / {
        #try_files $uri $uri/ =404;
        try_files $uri $uri/ /index.php$is_args$args;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
    }

    location = /favicon.ico { log_not_found off; access_log off; }
    location = /robots.txt { log_not_found off; access_log off; allow all; }
    location ~ /\.ht {
        deny all;
    }
    location ~* \.(css|gif|ico|jpeg|jpg|js|png)$ {
        expires max;
        log_not_found off;
    }

    #listen [::]:443 ssl ipv6only=on default deferred; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    #Config to enable HSTS
    add_header Strict-Transort-Security: "max-age=63072000; includeSubdomains; preload" always;
    ssl_certificate /etc/letsencrypt/live/pyroballpcbs.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/pyroballpcbs.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
    #Disable insecure TLSv1.0
    ssl_protocols TLSv1.2 TLSv1.3;

}

server {
    if ($host = www.pyroballpcbs.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    if ($host = pyroballpcbs.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    listen 80;
    #listen [::]:80;
    add_header Strict-Transort-Security "max-age=63072000; includeSubdomains" always;

    server_name 10.1.10.15 pyroballpcbs.com www.pyroballpcbs.com;
    return 301 https://$host$request_uri; # managed by Certbot
}

以下是用于检查安全标头的 nmap 脚本的输出：

$ nmap -p 443 --script http-security-headers pyroballpcbs.com

Starting Nmap 7.01 ( https://nmap.org ) at 2019-03-13 00:39 PDT
Nmap scan report for pyroballpcbs.com
Host is up (0.00031s latency).
PORT    STATE SERVICE
443/tcp open  https
| http-security-headers:
|   Strict_Transport_Security:
|_    HSTS not configured in HTTPS Server

hstspreload.org 也出现了同样的问题，ssllabs.com 的扫描仪也是如此：

https://hstspreload.org/?domain=pyroballpcbs.com

https://www.ssllabs.com/ssltest/analyze.html?d=pyroballpcbs.com&s=73.241.63.225

和 nginx 服务状态输出：

$ sudo service nginx status
â nginx.service - nginx - high performance web server
   Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: enabled)
   Active: active (running) since Wed 2019-03-13 00:39:48 PDT; 12min ago
     Docs: http://nginx.org/en/docs/
  Process: 19114 ExecStop=/bin/kill -s TERM $MAINPID (code=exited, status=0/SUCCESS)
  Process: 19116 ExecStart=/usr/sbin/nginx -c /etc/nginx/nginx.conf (code=exited, status=0/SUCCESS)
 Main PID: 19118 (nginx)
    Tasks: 2 (limit: 4915)
   CGroup: /system.slice/nginx.service
           ââ19118 nginx: master process /usr/sbin/nginx -c /etc/nginx/nginx.conf
           ââ19119 nginx: worker process

Mar 13 00:39:48 mail.pyroballpcbs.com systemd[1]: Stopped nginx - high performance web server.
Mar 13 00:39:48 mail.pyroballpcbs.com systemd[1]: Starting nginx - high performance web server...
Mar 13 00:39:48 mail.pyroballpcbs.com systemd[1]: nginx.service: PID file /var/run/nginx.pid not readable (yet?) after start: No such file or directory
Mar 13 00:39:48 mail.pyroballpcbs.com systemd[1]: Started nginx - high performance web server.

答案1

您两次拼错了标题名称。

    add_header Strict-Transort-Security: "max-age=63072000; includeSubdomains; preload" always;

冒号也是没有必要的。

答案2

根据您分享的简短代码片段以及我对您的域名 pyroballpcbs.com 的 DNS 查找，我认为问题在于您在 IPv4 上访问服务器时在 IPv6 侦听器上配置了 HSTS：

IPv4 -->

$ dig +short pyroballpcbs.com
162.255.119.121
73.241.63.225

IPv6 -->

$ dig +short pyroballpcbs.com AAAA
$

根据上述情况，您的域名只能解析为 IPv4 地址，因此您无法通过将流量指向 pyroballpcbs.com 来访问您的 IPv6 侦听器

相关内容