GitLab之Nginx漏洞修复方案

绝地灬酷狼 2022-10-17 01:55 252阅读 0赞

###### 1、需求：nginx的resolver模块漏洞，涉及nginx版本0.60-1.20 ######

###### 2、解决方案： ######

1.  替换gitlab自带的nginx，方案比较复杂，会出现较多问题
2.  在gtilab外用nginx最新版再负载一层，这个方案不需要修改很多gitlab原有的配置，被暂时采用

###### 3、具体实践： ######

1.  下载最新版nginx(传送门->):[nginx下载][nginx]
2.  安装nginx：

> tar -xzvf nginx-1.21.0.tar.gz

> cd nginx-1.21.0

> ./configure --prefix=/usr/local/nginx --with-stream --with-pcre --add-module=/app/nginx-module-vts --with-http\_gzip\_static\_module --with-http\_stub\_status\_module

> make  
> make install

`PS：如果缺少对应包模块下载即可，这里就不贴链接了`  
3. 修改nginx.conf文件

#user nobody;
    worker_processes  1;
    
    #error_log logs/error.log;
    #error_log logs/error.log notice;
    #error_log logs/error.log info;
    
    #pid logs/nginx.pid;
    
    
    events { 
        worker_connections  1024;
    }
    
    
    http { 
        include       mime.types;
        default_type  application/octet-stream;
    
        #log_format main '$remote_addr - $remote_user [$time_local] "$request" '
        # '$status $body_bytes_sent "$http_referer" '
        # '"$http_user_agent" "$http_x_forwarded_for"';
    
        #access_log logs/access.log main;
    
        sendfile        on;
        #tcp_nopush on;
    
        #keepalive_timeout 0;
        keepalive_timeout  65;
    
        #gzip on;
        
        upstream gitlab { 
            server 127.0.0.1:18080;
        }
    
        server { 
            listen       80;
            server_name  10.10.10.10;
    
            #charset koi8-r;
    
            #access_log logs/host.access.log main;
    
            location / { 
                client_max_body_size 1024m;
                proxy_redirect off;
                proxy_set_header Host $host:$server_port;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_pass http://gitlab/;
    
                root   html;
                index  index.html index.htm;
            }
    
            #error_page 404 /404.html;
    
            # redirect server error pages to the static page /50x.html
            #
            error_page   500 502 503 504  /50x.html;
            location = /50x.html { 
                root   html;
            }
    
            # proxy the PHP scripts to Apache listening on 127.0.0.1:80
            #
            #location ~ \.php$ { 
            # proxy_pass http://127.0.0.1;
            #}
    
            # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
            #
            #location ~ \.php$ { 
            # root html;
            # fastcgi_pass 127.0.0.1:9000;
            # fastcgi_index index.php;
            # fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
            # include fastcgi_params;
            #}
    
            # deny access to .htaccess files, if Apache's document root
            # concurs with nginx's one
            #
            #location ~ /\.ht { 
            # deny all;
            #}
        }
    
    
        # another virtual host using mix of IP-, name-, and port-based configuration
        #
        #server { 
        # listen 8000;
        # listen somename:8080;
        # server_name somename alias another.alias;
    
        # location / { 
        # root html;
        # index index.html index.htm;
        # }
        #}
    
    
        # HTTPS server
        #
        #server { 
        # listen 443 ssl;
        # server_name localhost;
    
        # ssl_certificate cert.pem;
        # ssl_certificate_key cert.key;
    
        # ssl_session_cache shared:SSL:1m;
        # ssl_session_timeout 5m;
    
        # ssl_ciphers HIGH:!aNULL:!MD5;
        # ssl_prefer_server_ciphers on;
    
        # location / { 
        # root html;
        # index index.html index.htm;
        # }
        #}
    
    }

1.  启动nginx服务：

/usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx.conf

`Nginx开机自启动看这里：`

> https://blog.csdn.net/lihailin9073/article/details/102535717

1.  修改gitlab配置：

> vim /etc/gitlab/gitlab.rb

external_url 'http://10.10.10.10:18080'
    gitlab_rails['backup_path'] = "/gitlabdir/backups"
    gitlab_rails['backup_keep_time'] = 604800
    
    
    nginx['listen_addresses'] = ['127.0.0.1']
    nginx['client_max_body_size'] = '1024m'
    nginx['listen_port'] = 18080
    
    git_data_dirs({ 
      "default" => { 
        "path" => "/gitlabdir/git-data"
       }
    })
    
    
    postgresql['data_dir'] = "/gitlabdir/gitlab/postgresql/data"
    postgresql['dir'] = "/gitlabdir/gitlab/postgresql"
    postgresql['home'] = "/gitlabdir/gitlab/postgresql"

1.  更新下配置：

> gitlab-ctl reconfigure

1.  浏览器访问gitlab服务进行验证：http://10.10.10.10，成功即可！！

`为了测试耗费了很长时间，踩了N多坑，有问题请留言，希望能帮到各位，不要恶语相向，谢谢！`

[nginx]: https://nginx.org/en/download.html