bugfix: fixed configures of nginx.conf for security reasons (#1759)

removed working_directory and removed TLSv1 TLSv1.1 from ssl_protocols
apache · Jun 23, 2020 · d372fe2 · d372fe2
1 parent 550cf74
commit d372fe2
Show file tree

Hide file tree

Showing 3 changed files with 2 additions and 4 deletions.
diff --git a/bin/apisix b/bin/apisix
@@ -105,7 +105,6 @@ events {
 }
 
 worker_rlimit_core  {* worker_rlimit_core *};
-working_directory   /tmp/apisix_cores/;
 
 worker_shutdown_timeout 3;
 

diff --git a/conf/config.yaml b/conf/config.yaml
@@ -91,8 +91,8 @@ apisix:
     enable: true
     enable_http2: true
     listen_port: 9443
-    ssl_protocols: "TLSv1 TLSv1.1 TLSv1.2 TLSv1.3"
-    ssl_ciphers: "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA"
+    ssl_protocols: "TLSv1.2 TLSv1.3"
+    ssl_ciphers: "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"
     key_encrypt_salt: "edd1c9f0985e76a2"    #  If not set, will save origin ssl key into etcd.
                                             #  If set this, must be a string of length 16. And it will encrypt ssl key with AES-128-CBC
                                             #  !!! So do not change it after saving your ssl, it can't decrypt the ssl keys have be saved if you change !!

diff --git a/t/APISIX.pm b/t/APISIX.pm
@@ -102,7 +102,6 @@ add_block_preprocessor(sub {
 
     my $main_config = $block->main_config // <<_EOC_;
 worker_rlimit_core  500M;
-working_directory   $apisix_home;
 env APISIX_PROFILE;
 _EOC_
-Original file line number
+Diff line change
@@ Expand Up / @@ -105,7 +105,6 @@ events { @@
     }
     worker_rlimit_core  {* worker_rlimit_core *};
-    working_directory   /tmp/apisix_cores/;
     worker_shutdown_timeout 3;
@@ Expand Down @@