Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt and Nginx – State of the art secure web deployment

letsecure.me

Post reply on HN
Print view View original

61–70 of 85 posts

Re: Let's Encrypt and Nginx – State of the art secure web deployment

#62

Post by matt4077 »

ivansavz wrote: post #54
ran290 wrote: post #41

Earlier quoted context omitted.

I'm curious: why doesn't webroot work for your setup?

A dynamic script is handling all requests, so there is no "webroot" directory where you can put stuff for them to appear under /

You could quite easily add a location /.well-known rule to the server, right?

Re: Let's Encrypt and Nginx – State of the art secure web deployment

#66

Post by ruslo » 

  > sed -i 's|PasswordAuthentication yes|PasswordAuthentication no|g' /etc/ssh/sshd_config
Will not work if string is commented out:

  > grep PasswordAuthentication /etc/ssh/sshd_config
  # PasswordAuthentication yes
  > sed -i 's|PasswordAuthentication yes|PasswordAuthentication no|g' /etc/ssh/sshd_config
  > grep PasswordAuthentication /etc/ssh/sshd_config
  # PasswordAuthentication no

Re: Let's Encrypt and Nginx – State of the art secure web deployment

#67

Post by sleepychu »

I'm really not a fan of this domain grab to write a single article with no(t a lot of?) new information aimed at selling services from a single host. You're not the only person guilty of this but it feels quite misleading like the article is coming from a 3rd party.

Re: Let's Encrypt and Nginx – State of the art secure web deployment

#68

Post by alexpeattie »

You can create a more hardened setup by using a 4096 bit RSA key:

  /opt/letsencrypt/letsencrypt-auto certonly --rsa-key-size 4096 --server https://acme-v01.api.letsencrypt.org/directory -a webroot --webroot-path=$DIR -d $DOMAINS
...and using the secp384r1 curve for ECDHE key exchange:

  # in your nginx.conf
  ssl_ecdh_curve secp384r1;
Arguably, the real state of the art is to use an ECDSA certificate. Let's Encrypt recently started supported them, they offer a equivalent level of security to RSA at much lower bit lengths (a 384 bit ECDSA key is considered equivalent to a 7680 bit RSA key) and a few recent TLS vulnerabilities (like DROWN) have targeted implementation details of RSA.

Re: Let's Encrypt and Nginx – State of the art secure web deployment

#69

Post by lamby »

schoen wrote: post #25

It scared me to see that the author recommended running curl http://nginx.org/keys/nginx_signing.key | sudo apt-key add - (This adds a key or keys downloaded over an unauthenticated http connection to one's Debian keyring, allowing whatever keys the network sends back to authenticate any future package updates.) I wrote to the author with a note expressing my concern.

Note that it also does not limit the key to simple nginx packages - if I take control of that repo I could trick you into installing my version of, say, base-files or bash, etc.. :(

Re: Let's Encrypt and Nginx – State of the art secure web deployment

#70

Post by cdubzzz »

dfc wrote: post #42
cdubzzz wrote: post #18

Earlier quoted context omitted.

Getting off-topic here, but whenever I do a new Debian build one of the items on my checklist is to edit /etc/aliases to add either my actual login user or a real email address (depending on the server setup) as an alias for root.

You are doing your Debian installs with debconf set way too high. I always set debconf to "low" but I am 99% positive this is a default question during installation.

Interesting. I'll try that next time. Thanks!
Post reply on HN