4513-nginx-header-session-pfs - Disable Session Resumption to Achieve Perfect Forward Secrecy¶

Rule ID¶

• 4513-nginx-header-session-pfs

Category¶

• nginx

Level¶

• info

Compatible Versions¶

• Linux

Description¶

• Session resumption for HTTPS sessions should be disabled to enable Perfect Forward Secrecy (PFS).

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• Perfect Forward Secrecy (PFS) is a cryptographic mechanism that prevents past session keys from being compromised even if the server's private key is leaked. If an attacker records all traffic to the server and stores it, then obtains the private key without PFS, all communications will be compromised. With PFS, session keys are generated per session using Diffie-Hellman, isolating potential session leakage to only that communication session. Allowing session resumption breaks PFS; if an attacker can compromise previous sessions and communications with the server, this expands the attacker's scope.

Risk Items¶

• nginx security

Audit Method¶

• Execute the following command to verify:

grep -ir ssl_session_tickets /etc/nginx
# Output should contain:
ssl_session_tickets off;

Remediation¶

• Edit the file /etc/nginx/nginx.conf or any file containing HTTPS configuration. Example:

ssl_session_tickets off;

Impact¶

• None

Default Value¶

• Perfect Forward Secrecy is not enabled by default.

References¶

• imperialviolet
• perfect-forward-secrecy

CIS Controls¶

• None