27 lines
991 B
Bash
27 lines
991 B
Bash
#!/bin/sh
|
||
# Audit: attack surface minimization (docs/Минимизация_поверхности_атаки_nginx)
|
||
set -eu
|
||
|
||
REPORT="${REPORT:-/reports/audit.log}"
|
||
|
||
{
|
||
echo ""
|
||
echo "=== Attack surface audit $(date -Iseconds) ==="
|
||
echo "--- nginx -V ---"
|
||
nginx -V 2>&1
|
||
echo "--- load_module ---"
|
||
nginx -T 2>/dev/null | grep load_module || echo "(none)"
|
||
echo "--- optional modules in config ---"
|
||
nginx -T 2>/dev/null | grep -E 'dav_methods|perl|js_import|js_content|xslt_stylesheet|auth_request' || echo "(none found)"
|
||
echo "--- autoindex ---"
|
||
nginx -T 2>/dev/null | grep autoindex || echo "(default off)"
|
||
echo "--- limit_except / request_method ---"
|
||
nginx -T 2>/dev/null | grep -E 'limit_except|request_method' || true
|
||
echo "--- proxy_pass / upstream ---"
|
||
nginx -T 2>/dev/null | grep -E 'proxy_pass|upstream' || true
|
||
echo "--- ssi ---"
|
||
nginx -T 2>/dev/null | grep -i 'ssi on' || echo "(ssi off)"
|
||
} >> "$REPORT"
|
||
|
||
echo "Attack surface audit appended -> $REPORT"
|