4508-nginx-defindex-NGINX default index page should not reference NGINX fields¶

Rule ID¶

• 4508-nginx-defindex

Category¶

• nginx

Level¶

• info

Compatible Versions¶

• Linux

Description¶

• NGINX's default error and index.html pages display the server as NGINX. These default pages should be removed or modified so that they do not advertise the server's underlying infrastructure.

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• By gathering information about the server, attackers can target known vulnerabilities. Removing pages that show the server is running NGINX helps reduce targeted attacks against the server.

Risk Item¶

• NGINX Security

Audit Method¶

• Execute the following commands to verify:

grep -i nginx /usr/share/nginx/html/index.html
grep -i nginx /usr/share/nginx/html/50x.html
grep -i nginx /usr/share/nginx/html/404.html
# The output should not contain the 'nginx' string

Remediation¶

• Edit these files: /usr/share/nginx/html/index.html /usr/share/nginx/html/50x.html /usr/share/nginx/html/404.html Remove the relevant fields and lines containing NGINX.

Impact¶

• None

Default Value¶

• By default, these files contain NGINX fields.

References¶

• None

CIS Controls¶

• None