Refine workshop UI navigation and hardening guidance
This commit is contained in:
hkoeck
@@ -65,6 +65,8 @@
|
||||
}
|
||||
|
||||
code {
|
||||
font-family: "JetBrains Mono", "Fira Code", "Consolas", "Liberation Mono", monospace;
|
||||
font-size: 0.92em;
|
||||
background: #0d1f31;
|
||||
border: 1px solid #2d4f6e;
|
||||
border-radius: 6px;
|
||||
@@ -75,8 +77,20 @@
|
||||
background: #0b2133;
|
||||
border: 1px solid #2b5578;
|
||||
border-radius: 10px;
|
||||
padding: 0.7rem;
|
||||
overflow: auto;
|
||||
padding: 0.75rem 0.85rem;
|
||||
overflow-x: auto;
|
||||
margin: 0.65rem 0;
|
||||
}
|
||||
|
||||
pre code {
|
||||
display: block;
|
||||
background: transparent;
|
||||
border: 0;
|
||||
border-radius: 0;
|
||||
padding: 0;
|
||||
font-size: 0.92rem;
|
||||
line-height: 1.45;
|
||||
white-space: pre;
|
||||
}
|
||||
|
||||
.top-links {
|
||||
@@ -153,6 +167,7 @@
|
||||
<p>Manuelle Proxy-Konfiguration, Security-Entscheidungen und TLS von Grund auf.</p>
|
||||
<div class="top-links">
|
||||
<a class="pill" href="/">Startseite</a>
|
||||
<a class="pill" href="/challenges.html">Challenges</a>
|
||||
<a class="pill" href="/hints.html">Hints</a>
|
||||
<a class="pill" href="/solutions.html">Solutions</a>
|
||||
<a class="pill" href="/service/a">Backend A</a>
|
||||
@@ -172,9 +187,10 @@
|
||||
<section class="panel">
|
||||
<h2>Easy</h2>
|
||||
|
||||
<details open>
|
||||
<details>
|
||||
<summary><span class="badge easy">Easy</span> 1) Routing verstehen (aktiv)</summary>
|
||||
<p><span class="kw">Muss:</span> zuerst in <code>proxy/nginx.conf</code> nachsehen, dann testen.</p>
|
||||
<p><span class="kw">Warum wichtig:</span> Routing ist die Grundfunktion jedes Reverse Proxys - ohne sauberes Matching ist alles andere instabil.</p>
|
||||
<ul>
|
||||
<li>Welche <code>location</code> matched <code>/service/a</code>?</li>
|
||||
<li>Welcher <code>upstream</code> wird verwendet?</li>
|
||||
@@ -187,6 +203,7 @@ curl http://localhost:8080/service/b</code></pre>
|
||||
<summary><span class="badge easy">Easy</span> 2) backend-c hinzufuegen</summary>
|
||||
<p><span class="kw">Muss:</span> Compose-Service + Upstream + Route <code>/service/c</code>.</p>
|
||||
<p><span class="kw">Zusatz:</span> <code>backends/c/index.html</code> ist vorhanden und darf angepasst werden.</p>
|
||||
<p><span class="kw">Warum wichtig:</span> Neue Services kommen laufend dazu; Erweiterungen ohne Seiteneffekte sind Praxisalltag.</p>
|
||||
<pre><code>curl http://localhost:8080/service/c
|
||||
curl http://localhost:8080/service/a
|
||||
curl http://localhost:8080/service/b</code></pre>
|
||||
@@ -195,6 +212,7 @@ curl http://localhost:8080/service/b</code></pre>
|
||||
<details>
|
||||
<summary><span class="badge easy">Easy</span> 3) Eigene Route /demo/a</summary>
|
||||
<p><span class="kw">Muss:</span> Alias-Route bauen, die auf Backend A fuehrt.</p>
|
||||
<p><span class="kw">Warum wichtig:</span> Der Proxy entkoppelt externe Pfade von internen Backend-Implementierungen.</p>
|
||||
<pre><code>curl http://localhost:8080/demo/a</code></pre>
|
||||
</details>
|
||||
</section>
|
||||
@@ -204,7 +222,9 @@ curl http://localhost:8080/service/b</code></pre>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge medium">Medium</span> 4) Security Headers</summary>
|
||||
<p>Setze mindestens <code>nosniff</code>, <code>DENY</code>, <code>no-referrer</code>.</p>
|
||||
<p>Setze mindestens <code>nosniff</code>, <code>DENY</code>, <code>strict-origin-when-cross-origin</code>, <code>Permissions-Policy</code>, <code>COOP</code>, <code>CORP</code>.</p>
|
||||
<p><span class="kw">Optional:</span> CSP fuer statische Seiten.</p>
|
||||
<p><span class="kw">Warum wichtig:</span> Diese Header reduzieren konkrete Browser-Angriffsvektoren und gehoeren zur Security-Baseline.</p>
|
||||
<pre><code>curl -I http://localhost:8080/</code></pre>
|
||||
</details>
|
||||
|
||||
@@ -212,6 +232,7 @@ curl http://localhost:8080/service/b</code></pre>
|
||||
<summary><span class="badge medium">Medium</span> 5) Interne Route absichern</summary>
|
||||
<p><span class="kw">Muss:</span> <code>/internal/status</code> nur fuer <code>127.0.0.1</code>.</p>
|
||||
<p><span class="kw">Wichtig:</span> Host-Request zeigt typischerweise 403 (Docker-Netzwerk).</p>
|
||||
<p><span class="kw">Warum wichtig:</span> Nicht jeder Endpoint darf oeffentlich erreichbar sein; Netzsegmentierung beginnt oft am Proxy.</p>
|
||||
<pre><code>curl -i http://localhost:8080/internal/status
|
||||
./scripts/compose.sh exec -T reverse-proxy sh -lc "wget -qO- http://127.0.0.1/internal/status"</code></pre>
|
||||
</details>
|
||||
@@ -219,6 +240,7 @@ curl http://localhost:8080/service/b</code></pre>
|
||||
<details>
|
||||
<summary><span class="badge medium">Medium</span> 6) Logging verbessern</summary>
|
||||
<p>Eigenes <code>log_format</code> mit Upstream-Infos einbauen.</p>
|
||||
<p><span class="kw">Warum wichtig:</span> Ohne brauchbare Logs dauert Fehleranalyse deutlich laenger und Incident-Response wird unzuverlaessig.</p>
|
||||
<pre><code>curl http://localhost:8080/service/a
|
||||
./scripts/compose.sh logs reverse-proxy</code></pre>
|
||||
</details>
|
||||
@@ -226,20 +248,24 @@ curl http://localhost:8080/service/b</code></pre>
|
||||
<details>
|
||||
<summary><span class="badge medium">Medium</span> 6a) Load Balancing</summary>
|
||||
<p>Zweite Instanz von Backend A (<code>backend-a2</code>) einbauen und Round-Robin zeigen.</p>
|
||||
<p><span class="kw">Warum wichtig:</span> Lastverteilung ist Kernnutzen eines Reverse Proxys fuer Skalierung und Verfuegbarkeit.</p>
|
||||
<pre><code>for i in $(seq 1 8); do
|
||||
curl -s http://localhost:8080/service/a | grep -o "Target A2\|Target A"
|
||||
done</code></pre>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge medium">Medium</span> 6b) Header Stripping</summary>
|
||||
<summary><span class="badge medium">Medium</span> 6b) Response Header Minimization</summary>
|
||||
<p>Mindestens einen Backend-Response-Header per <code>proxy_hide_header</code> ausblenden.</p>
|
||||
<p><span class="kw">Abgrenzung zu #4:</span> #4 setzt Schutz-Header, #6b entfernt unnoetige Header aus Upstream-Responses.</p>
|
||||
<p><span class="kw">Warum wichtig:</span> Weniger preisgegebene Metadaten erschweren Fingerprinting und zielgerichtete Angriffe.</p>
|
||||
<pre><code>curl -I http://localhost:8080/service/a</code></pre>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge medium">Medium</span> 6c) Debugging Challenge</summary>
|
||||
<p>Mit <code>proxy/nginx.broken.conf</code> arbeiten, Fehler finden und reparieren.</p>
|
||||
<p><span class="kw">Warum wichtig:</span> In der Praxis geht es oft um Diagnose unter Zeitdruck, nicht nur um Greenfield-Konfiguration.</p>
|
||||
<pre><code>curl http://localhost:8080/service/a
|
||||
curl http://localhost:8080/service/b
|
||||
./scripts/compose.sh logs reverse-proxy</code></pre>
|
||||
@@ -252,18 +278,21 @@ curl http://localhost:8080/service/b
|
||||
<details>
|
||||
<summary><span class="badge hard">Hard</span> 7) HTTPS von 0 (Easy-RSA)</summary>
|
||||
<p>Zertifikat fuer <code>localhost</code>, Port <code>8443:443</code>, Root-CA importiert.</p>
|
||||
<p><span class="kw">Warum wichtig:</span> TLS-Grundaufbau ist Voraussetzung fuer vertrauliche und manipulationssichere Kommunikation.</p>
|
||||
<pre><code>curl https://localhost:8443/service/a</code></pre>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge hard">Hard</span> 8) HTTP -> HTTPS Redirect</summary>
|
||||
<p><span class="kw">Voraussetzung:</span> Challenge 7 abgeschlossen. Bestehende Config weiterverwenden.</p>
|
||||
<p><span class="kw">Warum wichtig:</span> Redirect verhindert unabsichtliche Klartext-Nutzung und erzwingt den sicheren Transport.</p>
|
||||
<pre><code>curl -I http://localhost:8080/service/a</code></pre>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge hard">Hard</span> 9) TLS Haertung + Chain + HSTS</summary>
|
||||
<p><span class="kw">Voraussetzung:</span> Challenge 7 und 8 abgeschlossen. Gleiche Config weiter erweitern.</p>
|
||||
<p><span class="kw">Warum wichtig:</span> Erst Haertung + HSTS reduzieren Downgrade-Risiken und sorgen fuer dauerhaft sichere Clients.</p>
|
||||
<pre><code>curl -I https://localhost:8443/service/a
|
||||
openssl s_client -connect localhost:8443 -servername localhost</code></pre>
|
||||
</details>
|
||||
@@ -272,8 +301,9 @@ openssl s_client -connect localhost:8443 -servername localhost</code></pre>
|
||||
<section class="panel">
|
||||
<h2>Bonus Expert</h2>
|
||||
|
||||
<details open>
|
||||
<details>
|
||||
<summary><span class="badge expert">Expert</span> 10) Wireshark: HTTP vs HTTPS sauber ausarbeiten</summary>
|
||||
<p><span class="kw">Warum wichtig:</span> Sichtbarkeit auf Paketebene macht den Sicherheitsgewinn von TLS fuer alle nachvollziehbar.</p>
|
||||
<ol>
|
||||
<li>HTTP auf <code>8080</code> mitschneiden und Klartext zeigen.</li>
|
||||
<li>HTTPS auf <code>8443</code> mitschneiden.</li>
|
||||
|
||||
+28
-2
@@ -74,6 +74,8 @@
|
||||
}
|
||||
|
||||
code {
|
||||
font-family: "JetBrains Mono", "Fira Code", "Consolas", "Liberation Mono", monospace;
|
||||
font-size: 0.92em;
|
||||
background: #0d1f31;
|
||||
border: 1px solid #2d4f6e;
|
||||
border-radius: 6px;
|
||||
@@ -84,8 +86,20 @@
|
||||
background: #0b2133;
|
||||
border: 1px solid #2b5578;
|
||||
border-radius: 10px;
|
||||
padding: 0.7rem;
|
||||
overflow: auto;
|
||||
padding: 0.75rem 0.85rem;
|
||||
overflow-x: auto;
|
||||
margin: 0.65rem 0;
|
||||
}
|
||||
|
||||
pre code {
|
||||
display: block;
|
||||
background: transparent;
|
||||
border: 0;
|
||||
border-radius: 0;
|
||||
padding: 0;
|
||||
font-size: 0.92rem;
|
||||
line-height: 1.45;
|
||||
white-space: pre;
|
||||
}
|
||||
|
||||
.top-links {
|
||||
@@ -116,7 +130,10 @@
|
||||
<div class="top-links">
|
||||
<a class="pill" href="/">Startseite</a>
|
||||
<a class="pill" href="/challenges.html">Challenges</a>
|
||||
<a class="pill" href="/hints.html">Hints</a>
|
||||
<a class="pill" href="/solutions.html">Solutions</a>
|
||||
<a class="pill" href="/service/a">Backend A</a>
|
||||
<a class="pill" href="/service/b">Backend B</a>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
@@ -171,6 +188,15 @@ openssl s_client -connect localhost:8443 -servername localhost</code></pre>
|
||||
<p>Bei TLS-Haertung auf <code>Strict-Transport-Security</code> im Header achten.</p>
|
||||
<p>Komplettes TLS-Beispiel: <code>proxy/nginx.tls.example.conf</code></p>
|
||||
</article>
|
||||
<article class="card">
|
||||
<h3>Security Header Baseline</h3>
|
||||
<pre><code>add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-Frame-Options "DENY" always;
|
||||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
||||
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
|
||||
add_header Cross-Origin-Opener-Policy "same-origin" always;
|
||||
add_header Cross-Origin-Resource-Policy "same-origin" always;</code></pre>
|
||||
</article>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
|
||||
@@ -58,6 +58,8 @@
|
||||
}
|
||||
|
||||
code {
|
||||
font-family: "JetBrains Mono", "Fira Code", "Consolas", "Liberation Mono", monospace;
|
||||
font-size: 0.92em;
|
||||
background: #0d1f31;
|
||||
border: 1px solid #2d4f6e;
|
||||
border-radius: 6px;
|
||||
@@ -68,7 +70,7 @@
|
||||
color: var(--accent);
|
||||
}
|
||||
|
||||
.links {
|
||||
.top-links {
|
||||
display: flex;
|
||||
flex-wrap: wrap;
|
||||
gap: 0.5rem;
|
||||
@@ -105,12 +107,13 @@
|
||||
Basis läuft mit HTTP. Ziel im Workshop: Reverse Proxy verstehen und HTTPS/TLS manuell
|
||||
aufbauen.
|
||||
</p>
|
||||
<div class="links">
|
||||
<a class="pill" href="/service/a">Backend A</a>
|
||||
<a class="pill" href="/service/b">Backend B</a>
|
||||
<div class="top-links">
|
||||
<a class="pill" href="/">Startseite</a>
|
||||
<a class="pill" href="/challenges.html">Challenges</a>
|
||||
<a class="pill" href="/hints.html">Hints</a>
|
||||
<a class="pill" href="/solutions.html">Solutions</a>
|
||||
<a class="pill" href="/service/a">Backend A</a>
|
||||
<a class="pill" href="/service/b">Backend B</a>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
|
||||
@@ -65,6 +65,8 @@
|
||||
}
|
||||
|
||||
code {
|
||||
font-family: "JetBrains Mono", "Fira Code", "Consolas", "Liberation Mono", monospace;
|
||||
font-size: 0.92em;
|
||||
background: #0d1f31;
|
||||
border: 1px solid #2d4f6e;
|
||||
border-radius: 6px;
|
||||
@@ -75,8 +77,20 @@
|
||||
background: #0b2133;
|
||||
border: 1px solid #2b5578;
|
||||
border-radius: 10px;
|
||||
padding: 0.7rem;
|
||||
overflow: auto;
|
||||
padding: 0.75rem 0.85rem;
|
||||
overflow-x: auto;
|
||||
margin: 0.65rem 0;
|
||||
}
|
||||
|
||||
pre code {
|
||||
display: block;
|
||||
background: transparent;
|
||||
border: 0;
|
||||
border-radius: 0;
|
||||
padding: 0;
|
||||
font-size: 0.92rem;
|
||||
line-height: 1.45;
|
||||
white-space: pre;
|
||||
}
|
||||
|
||||
.top-links {
|
||||
@@ -151,10 +165,12 @@
|
||||
<section class="panel">
|
||||
<h1>Solutions Board (detailliert)</h1>
|
||||
<p>Hier stehen absichtlich konkrete Musterloesungen mit Snippets, Checks und typischen Stolperfallen.</p>
|
||||
<p><span class="kw">Workflow:</span> Nach jeder Konfig-Aenderung mindestens <code>make proxy-reload</code>, bei Compose-Aenderungen <code>make redeploy</code>.</p>
|
||||
<div class="top-links">
|
||||
<a class="pill" href="/">Startseite</a>
|
||||
<a class="pill" href="/challenges.html">Challenges</a>
|
||||
<a class="pill" href="/hints.html">Hints</a>
|
||||
<a class="pill" href="/solutions.html">Solutions</a>
|
||||
<a class="pill" href="/service/a">Backend A</a>
|
||||
<a class="pill" href="/service/b">Backend B</a>
|
||||
</div>
|
||||
@@ -163,8 +179,10 @@
|
||||
<section class="panel">
|
||||
<h2>Easy - Musterloesungen</h2>
|
||||
|
||||
<details open>
|
||||
<details>
|
||||
<summary><span class="badge easy">Easy</span> 1) Routing verstehen</summary>
|
||||
<p><span class="kw">Dateien:</span> nur lesen: <code>proxy/nginx.conf</code></p>
|
||||
<p><span class="kw">Commands noetig:</span> ja</p>
|
||||
<pre><code>curl http://localhost:8080/service/a
|
||||
curl http://localhost:8080/service/b</code></pre>
|
||||
<p><span class="kw">Erwartete Erklaerung:</span> Nginx matched den Pfad in <code>location</code> und leitet auf den passenden <code>upstream</code> weiter.</p>
|
||||
@@ -172,6 +190,8 @@ curl http://localhost:8080/service/b</code></pre>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge easy">Easy</span> 2) backend-c hinzufuegen</summary>
|
||||
<p><span class="kw">Dateien:</span> <code>docker-compose.yml</code>, <code>proxy/nginx.conf</code>, <code>backends/c/index.html</code></p>
|
||||
<p><span class="kw">Commands noetig:</span> ja</p>
|
||||
<p><span class="kw">Compose (Beispiel):</span></p>
|
||||
<pre><code>backend-c:
|
||||
image: nginx:1.27-alpine
|
||||
@@ -195,6 +215,8 @@ location /service/c {
|
||||
|
||||
<details>
|
||||
<summary><span class="badge easy">Easy</span> 3) Rewrite Route</summary>
|
||||
<p><span class="kw">Dateien:</span> <code>proxy/nginx.conf</code></p>
|
||||
<p><span class="kw">Commands noetig:</span> ja</p>
|
||||
<pre><code>location = /demo/a {
|
||||
proxy_pass http://backend_a/;
|
||||
}</code></pre>
|
||||
@@ -207,14 +229,23 @@ location /service/c {
|
||||
|
||||
<details>
|
||||
<summary><span class="badge medium">Medium</span> 4) Security Headers</summary>
|
||||
<p><span class="kw">Dateien:</span> <code>proxy/nginx.conf</code></p>
|
||||
<p><span class="kw">Commands noetig:</span> ja</p>
|
||||
<pre><code>add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-Frame-Options "DENY" always;
|
||||
add_header Referrer-Policy "no-referrer" always;</code></pre>
|
||||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
||||
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
|
||||
add_header Cross-Origin-Opener-Policy "same-origin" always;
|
||||
add_header Cross-Origin-Resource-Policy "same-origin" always;</code></pre>
|
||||
<p><span class="kw">Optional CSP (statisch, inline styles erlaubt):</span></p>
|
||||
<pre><code>add_header Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; base-uri 'none'; frame-ancestors 'none'" always;</code></pre>
|
||||
<p><span class="kw">Check:</span> <code>curl -I http://localhost:8080/</code></p>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge medium">Medium</span> 5) Interne Route absichern</summary>
|
||||
<p><span class="kw">Dateien:</span> <code>proxy/nginx.conf</code></p>
|
||||
<p><span class="kw">Commands noetig:</span> ja</p>
|
||||
<pre><code>location /internal/status {
|
||||
allow 127.0.0.1;
|
||||
deny all;
|
||||
@@ -228,6 +259,8 @@ add_header Referrer-Policy "no-referrer" always;</code></pre>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge medium">Medium</span> 6) Logging verbessern</summary>
|
||||
<p><span class="kw">Dateien:</span> <code>proxy/nginx.conf</code></p>
|
||||
<p><span class="kw">Commands noetig:</span> ja</p>
|
||||
<pre><code>log_format workshop '$remote_addr - $request '
|
||||
'status=$status upstream=$upstream_addr '
|
||||
'rt=$request_time urt=$upstream_response_time';
|
||||
@@ -240,6 +273,8 @@ access_log /var/log/nginx/access.log workshop;</code></pre>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge medium">Medium</span> 6a) Load Balancing</summary>
|
||||
<p><span class="kw">Dateien:</span> <code>docker-compose.yml</code>, <code>proxy/nginx.conf</code>, <code>backends/a2/index.html</code></p>
|
||||
<p><span class="kw">Commands noetig:</span> ja</p>
|
||||
<p><span class="kw">Compose (backend-a2):</span></p>
|
||||
<pre><code>backend-a2:
|
||||
image: nginx:1.27-alpine
|
||||
@@ -258,7 +293,10 @@ done</code></pre>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge medium">Medium</span> 6b) Header Stripping</summary>
|
||||
<summary><span class="badge medium">Medium</span> 6b) Response Header Minimization</summary>
|
||||
<p><span class="kw">Dateien:</span> <code>proxy/nginx.conf</code></p>
|
||||
<p><span class="kw">Commands noetig:</span> ja</p>
|
||||
<p><span class="kw">Abgrenzung zu #4:</span> #4 fuegt Schutz-Header hinzu, #6b entfernt unnoetige Upstream-Metadaten.</p>
|
||||
<pre><code>location /service/a {
|
||||
proxy_pass http://backend_a/;
|
||||
proxy_hide_header ETag;
|
||||
@@ -269,6 +307,8 @@ done</code></pre>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge medium">Medium</span> 6c) Debugging Challenge</summary>
|
||||
<p><span class="kw">Dateien:</span> <code>proxy/nginx.broken.conf</code>, <code>proxy/nginx.conf</code></p>
|
||||
<p><span class="kw">Commands noetig:</span> ja</p>
|
||||
<p>Kopiere testweise <code>proxy/nginx.broken.conf</code> auf <code>proxy/nginx.conf</code>, behebe die Fehler und stelle danach die funktionierende Konfiguration wieder her.</p>
|
||||
<pre><code>cp proxy/nginx.broken.conf proxy/nginx.conf
|
||||
make proxy-reload
|
||||
@@ -282,6 +322,8 @@ make proxy-reload
|
||||
|
||||
<details>
|
||||
<summary><span class="badge hard">Hard</span> 7) HTTPS mit Easy-RSA</summary>
|
||||
<p><span class="kw">Dateien:</span> <code>docker-compose.yml</code>, <code>proxy/nginx.conf</code>, <code>certs/easyrsa/*</code></p>
|
||||
<p><span class="kw">Commands noetig:</span> ja</p>
|
||||
<pre><code>mkdir -p certs/easyrsa
|
||||
cp -r /usr/share/easy-rsa/* certs/easyrsa/
|
||||
cd certs/easyrsa
|
||||
@@ -302,6 +344,8 @@ cd certs/easyrsa
|
||||
<details>
|
||||
<summary><span class="badge hard">Hard</span> 8) HTTP -> HTTPS Redirect</summary>
|
||||
<p><span class="kw">Voraussetzung:</span> Challenge 7 abgeschlossen (gleiches Config-File weiterverwenden).</p>
|
||||
<p><span class="kw">Dateien:</span> <code>proxy/nginx.conf</code></p>
|
||||
<p><span class="kw">Commands noetig:</span> ja</p>
|
||||
<pre><code>server {
|
||||
listen 80;
|
||||
server_name _;
|
||||
@@ -321,6 +365,8 @@ cd certs/easyrsa
|
||||
<details>
|
||||
<summary><span class="badge hard">Hard</span> 9) TLS Haertung + HSTS</summary>
|
||||
<p><span class="kw">Voraussetzung:</span> Challenge 7 und 8 abgeschlossen.</p>
|
||||
<p><span class="kw">Dateien:</span> <code>proxy/nginx.conf</code></p>
|
||||
<p><span class="kw">Commands noetig:</span> ja</p>
|
||||
<pre><code>ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_prefer_server_ciphers on;
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;</code></pre>
|
||||
@@ -334,8 +380,10 @@ openssl s_client -connect localhost:8443 -servername localhost</code></pre>
|
||||
<section class="panel">
|
||||
<h2>Bonus Expert - Wireshark (ausformulierte Referenzloesung)</h2>
|
||||
|
||||
<details open>
|
||||
<details>
|
||||
<summary><span class="badge expert">Expert</span> 10) HTTP vs HTTPS sauber analysieren</summary>
|
||||
<p><span class="kw">Dateien:</span> keine Pflicht-Datei; optional Wireshark Settings und Keylog-Datei</p>
|
||||
<p><span class="kw">Commands noetig:</span> ja</p>
|
||||
<p><span class="kw">Schritt 1 - HTTP Capture:</span></p>
|
||||
<ol>
|
||||
<li>Interface waehlen: lokal meist <code>lo</code>.</li>
|
||||
|
||||
@@ -42,7 +42,11 @@ http {
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-Frame-Options "DENY" always;
|
||||
add_header Referrer-Policy "no-referrer" always;
|
||||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
||||
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
|
||||
add_header Cross-Origin-Opener-Policy "same-origin" always;
|
||||
add_header Cross-Origin-Resource-Policy "same-origin" always;
|
||||
add_header Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; base-uri 'none'; frame-ancestors 'none'" always;
|
||||
|
||||
location / {
|
||||
root /usr/share/nginx/html;
|
||||
|
||||
Reference in New Issue
Block a user