init

results/scripts/run-audit-attack-surface.sh

@@ -0,0 +1,26 @@
+#!/bin/sh
+# Audit: attack surface minimization (docs/Минимизация_поверхности_атаки_nginx)
+set -eu
+
+REPORT="${REPORT:-/reports/audit.log}"
+
+{
+  echo ""
+  echo "=== Attack surface audit $(date -Iseconds) ==="
+  echo "--- nginx -V ---"
+  nginx -V 2>&1
+  echo "--- load_module ---"
+  nginx -T 2>/dev/null | grep load_module || echo "(none)"
+  echo "--- optional modules in config ---"
+  nginx -T 2>/dev/null | grep -E 'dav_methods|perl|js_import|js_content|xslt_stylesheet|auth_request' || echo "(none found)"
+  echo "--- autoindex ---"
+  nginx -T 2>/dev/null | grep autoindex || echo "(default off)"
+  echo "--- limit_except / request_method ---"
+  nginx -T 2>/dev/null | grep -E 'limit_except|request_method' || true
+  echo "--- proxy_pass / upstream ---"
+  nginx -T 2>/dev/null | grep -E 'proxy_pass|upstream' || true
+  echo "--- ssi ---"
+  nginx -T 2>/dev/null | grep -i 'ssi on' || echo "(ssi off)"
+} >> "$REPORT"
+
+echo "Attack surface audit appended -> $REPORT"