GitLab之Nginx漏洞修复方案

1、需求：nginx的resolver模块漏洞，涉及nginx版本0.60-1.20

2、解决方案：

替换gitlab自带的nginx，方案比较复杂，会出现较多问题
在gtilab外用nginx最新版再负载一层，这个方案不需要修改很多gitlab原有的配置，被暂时采用

3、具体实践：

下载最新版nginx(传送门->):nginx下载
安装nginx：

tar -xzvf nginx-1.21.0.tar.gz

cd nginx-1.21.0

./configure —prefix=/usr/local/nginx —with-stream —with-pcre —add-module=/app/nginx-module-vts —with-http_gzip_static_module —with-http_stub_status_module

make
make install

PS：如果缺少对应包模块下载即可，这里就不贴链接了

修改nginx.conf文件

user nobody;
worker_processes 1;

error_log logs/error.log;
error_log logs/error.log notice;
error_log logs/error.log info;
pid logs/nginx.pid;

events { 
    worker_connections  1024;
}
http { 
    include       mime.types;
    default_type  application/octet-stream;
    #log_format main '$remote_addr - $remote_user [$time_local] "$request" '
    # '$status $body_bytes_sent "$http_referer" '
    # '"$http_user_agent" "$http_x_forwarded_for"';
    #access_log logs/access.log main;
    sendfile        on;
    #tcp_nopush on;
    #keepalive_timeout 0;
    keepalive_timeout  65;
    #gzip on;
    upstream gitlab { 
        server 127.0.0.1:18080;
    }
    server { 
        listen       80;
        server_name  10.10.10.10;
        #charset koi8-r;
        #access_log logs/host.access.log main;
        location / { 
            client_max_body_size 1024m;
            proxy_redirect off;
            proxy_set_header Host $host:$server_port;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_pass http://gitlab/;
            root   html;
            index  index.html index.htm;
        }
        #error_page 404 /404.html;
        # redirect server error pages to the static page /50x.html
        #
        error_page   500 502 503 504  /50x.html;
        location = /50x.html { 
            root   html;
        }
        # proxy the PHP scripts to Apache listening on 127.0.0.1:80
        #
        #location ~ \.php$ { 
        # proxy_pass http://127.0.0.1;
        #}
        # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
        #
        #location ~ \.php$ { 
        # root html;
        # fastcgi_pass 127.0.0.1:9000;
        # fastcgi_index index.php;
        # fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
        # include fastcgi_params;
        #}
        # deny access to .htaccess files, if Apache's document root
        # concurs with nginx's one
        #
        #location ~ /\.ht { 
        # deny all;
        #}
    }
    # another virtual host using mix of IP-, name-, and port-based configuration
    #
    #server { 
    # listen 8000;
    # listen somename:8080;
    # server_name somename alias another.alias;
    # location / { 
    # root html;
    # index index.html index.htm;
    # }
    #}
    # HTTPS server
    #
    #server { 
    # listen 443 ssl;
    # server_name localhost;
    # ssl_certificate cert.pem;
    # ssl_certificate_key cert.key;
    # ssl_session_cache shared:SSL:1m;
    # ssl_session_timeout 5m;
    # ssl_ciphers HIGH:!aNULL:!MD5;
    # ssl_prefer_server_ciphers on;
    # location / { 
    # root html;
    # index index.html index.htm;
    # }
    #}
}

启动nginx服务：

/usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx.conf

Nginx开机自启动看这里：

https://blog.csdn.net/lihailin9073/article/details/102535717

修改gitlab配置：

vim /etc/gitlab/gitlab.rb

external_url 'http://10.10.10.10:18080'
gitlab_rails['backup_path'] = "/gitlabdir/backups"
gitlab_rails['backup_keep_time'] = 604800
nginx['listen_addresses'] = ['127.0.0.1']
nginx['client_max_body_size'] = '1024m'
nginx['listen_port'] = 18080
git_data_dirs({ 
  "default" => { 
    "path" => "/gitlabdir/git-data"
   }
})
postgresql['data_dir'] = "/gitlabdir/gitlab/postgresql/data"
postgresql['dir'] = "/gitlabdir/gitlab/postgresql"
postgresql['home'] = "/gitlabdir/gitlab/postgresql"