init

2026-06-15 06:31:35 +03:00
commit fcc9139361
50 changed files with 5400 additions and 0 deletions
--- a/results/reports/2026-06-14_06-37-41_summary.md
+++ b/results/reports/2026-06-14_06-37-41_summary.md
@@ -0,0 +1,69 @@
+# Сводный отчёт nginx PMI stand
+
+**Дата прогона:** 2026-06-14_06-37-41
+**Стенд:** Docker Compose (`results/docker-compose.yml`)
+
+## Результаты ПМИ
+
+| Метрика | Значение |
+|---------|----------|
+| PASS | 23 |
+| FAIL | 0 |
+
+## Целостность (FIM stand-in)
+
+| Метрика | Значение |
+|---------|----------|
+| PASS | 4 |
+| FAIL | 0 |
+
+> FIM выполнен через SHA256 baseline (`run-fim-checksum.sh`), не afick.
+> Syslog проверялся локальным syslog-ng, не корпоративным SIEM.
+
+## Файлы отчётов
+
+- [`2026-06-14_06-37-41_pmi.log`](2026-06-14_06-37-41_pmi.log)
+- [`2026-06-14_06-37-41_audit.log`](2026-06-14_06-37-41_audit.log)
+- [`2026-06-14_06-37-41_fim.log`](2026-06-14_06-37-41_fim.log)
+
+## PMI log excerpt
+
+```
+=== PMI tests 2026-06-14T06:37:49+00:00 ===
+PASS  #1 IP allow/deny (allowed=200 denied=403)
+PASS  #2 Basic auth (401/401/200)
+PASS  #3 Client TLS certificate (400/200/400)
+PASS  #4 auth_request (200/401/403)
+PASS  #5 satisfy all matrix (200/401/403/403)
+PASS  #6 URL access rules (/public/ vs /admin/)
+PASS  #7 limit_except GET POST (PUT/DELETE=403)
+PASS  #8 internal location (direct=404 rewrite=200)
+PASS  #9 HTTPS TLS handshake
+PASS  #10 TLSv1.2 ok, TLSv1.1 rejected
+PASS  #11 HTTP redirect 301 + HSTS header
+PASS  #14 syslog receives nginx events
+PASS  #15 limit_req returns 503 (3) and 200 (2) in: 200 200 503 503 503
+PASS  #16 limit_conn returns 503 (200200503503503)
+PASS  #17 client_max_body_size (small=200 large=413)
+PASS  #18 client_body_timeout (curl exit 1)
+PASS  #19 server_tokens off
+PASS  #20 custom error_page 404
+PASS  #21 autoindex off (403, no listing)
+PASS  #22 proxy_pass to backend (200)
+PASS  #23 web root restriction (200/404)
+=== Summary: PASS=21 FAIL=0 SKIP=0 ===
+PASS  #12 access_log contains test-page and another-page
+PASS  #13 error_log contains upstream error
+```
+
+## FIM log excerpt
+
+```
+FIM checksum audit 2026-06-14T06:38:01+00:00
+NOTE: SHA256 baseline substitute for afick on test stand only.
+Baseline created (22 files)
+PASS  baseline check (no changes)
+PASS  tamper detected after file change (/fim-watch/config.snippet)
+PASS  baseline restored after revert
+PASS  #24 integrity control (checksum substitute for afick)
+```