Securing your Web services using Nginx

If we have an API service and want to publish to public, better use a reverse proxy like nginx to handle all the dirty traffic trying to taken down your services.

With Nginx you will make your API server live prosper and not minding the dirty request which should not coming on your server if not using Nginx in front of it.

So lets do the Nginx configuration for securing your backend API server.

    add_header Cache-Control public;

    add_header X-frame-Options "DENY";

    add_header X-Xss-Protection "1; mode=block" always;

    add_header Content-Security-Policy-Report-Only "script-src https://skyway.shineapi.net";

    add_header X-Content-Type-Options "nosniff" always;

    add_header Strict-Transport-Security 'max-age=31536000;includeSubDomains;preload;' always;

    add_header Referrer-Policy no-referrer-when-downgrade;

 
   if ($http_referer = "") {  return 403; }


With above configuration, any request incoming your API will be handled by Nginx and protected by the header config which is web security standards for securing any web app in the wild.

For the explanation i will put on another blog post for details.

Read More

IT Asset Management Software

Do you have ever experience trouble in managing your Assets in your organizatoin, especially within the scope of IT Assets like PC, laptop, accessories, etc which related to day to day operation ?

Manual will be using spreadsheets application available. More advance are using a specialized software which manage your assets and logs where about the assets and status.

Come the rescue, Snipeit asset management. Its a software based asset management with full feature to manage your assets and also come as a free open source software. Of course with free meanings, you can do it all by yourself to make it works, besides your skill on translate the documentation to working application.

Here you need to know that Snipeit application is a :
1. PHP based application
2. Need a database to function properly, eg. Mariadb or Postgresql.
3. Multiuser applicatoin
4. Support LDAP integration for corporate environment.
5. Can run both on Linux / Windows server as a web services

With this information, you should know what basic prerequisite needed.

For my journey, i come to Snipeit because organization i work for need an asset management software to manage all operation related activity and keep track of the asset owned by organization. This will be a second step after doing manual labour works using spreadsheets.

What i recommend to setup are using High Availability setup for uninterupted service, as these are web service, its easy to do the High Availablility setup, especially the web service part.

What can we do are using this design :

User ---------   HA Proxy               --->   Snipeit App 01   ----->    |    Snipeit Database
                       Load Balancer        --->  Snipeit APP 02    ----->    |

With this setup, access from user are load balanced between Snipeit AP 01 and 02 to provide high availability and load balancing within the application.

Working Snipeit IT ASSET Management Systems

The software we used are :
1. Centos 7.x
2. HA Proxy
3. Nginx
4. PHP7.2
5. MariaDB 10
6. Memcached

Read More

Running CGI script on Nginx Web Server on FreeBSD

Yes CGI is an old technology. I encounter to be able run an old CGI script for testing on my development project. And i am using Nginx stack rather than install apache. So we can run CGI script with Nginx web server. Here how i do it and documenting it here.

on FreeBSD 9.0 server, we using fcgiwrap application.

#cd /usr/ports/www/fcgiwrap/
#make install clean

Then enable it to run in /etc/rc.conf  :

#echo "fcgiwrap_enable='YES'" >> /etc/rc.conf

Then start the fcgiwrap. it will be available in /var/run/fcgiwrap/fcgiwrap.sock

To use it, just redirect the script to be run with fcgiwrap.sock.

Here the nginx setup.

server {

      listen  80;
      server_name    login.freehostspotsystem.com;

      location / {
         root /usr/local/www/super/system/free;
         index index.html index.html;
      }
       
     location /cgi-bin/ 
     {
         gzip off;
         root /usr/local/www/super/system/free;
         fastcgi_pass unix:/var/run/fcgiwrap/fcgiwrap.sock;
         
         include /usr/local/etc/nginx/fastcgi_params;
         fastcgi_param  SCRIPT_FILENAME $document_root$fastcgi_script_name;

     }

And put your cgi file in /usr/local/www/super/system/free/cgi-bin/login.cgi

so when user go to http://login.freehotspotsystem.com/cgi-bin/login.cgi  , user will got the page.

Read More