nginx服务器信息泄露漏洞新发现,Encrypt+nginx之漏洞 SSL/TLS协议信息泄露漏洞(CVE-2016-2183)...-CSDN博客

根据漏洞扫描的提示查看官网给出的解释，如下:

SWEET32 Mitigation (CVE-2016-2183)

SWEET32 (https://sweet32.info) is an attack on older block cipher algorithms that use a block size of 64 bits. In mitigation for the SWEET32 attack DES based ciphersuites have been moved from the HIGH cipherstring group to MEDIUM in OpenSSL 1.0.1 and OpenSSL 1.0.2. OpenSSL 1.1.0 since release has had these ciphersuites disabled by default.

OpenSSL 1.0.2 users should upgrade to 1.0.2i

OpenSSL 1.0.1 users should upgrade to 1.0.1u

根据官网要求升级对应大版本到指定的分支，比如我默认的是centos6自带的1.0.1e，这个版本是有很多漏洞的，按照要求准备升级到1.0.1u

步骤

一、执行脚本文件进行下载对应版本openssl，代码如下：

wget http://www.openssl.org/source/openssl-1.0.1u.tar.gz

sudo tar xzvf openssl-1.0.1u.tar.gz

cd openssl-1.0.1u

sudo ./config shared zlib

make && make install

sudo chmod 777 /usr/local/ssl

cd /usr/local/ssl/

sudo ./bin/openssl version -a

#替换旧版openssl

sudo mv /usr/bin/openssl /usr/bin/openssl.old2

sudo mv /usr/include/openssl /usr/include/openssl.old2

sudo ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl

sudo ln -s /usr/local/ssl/include/openssl/ /usr/include/openssl

#配置库文件搜索路径

#root的写法 echo “/usr/local/ssl/lib” >> /etc/ld.so.conf

echo “/usr/local/ssl/lib” |sudo tee -a /etc/ld.so.conf

sudo ldconfig

#测试新版是否正常

openssl version -a

二、重新编译nginx，指定相应的新版本的openssl模块

1、找到之前下载的nginx源码包，我的是nginx-1.16.1，进入主目录执行如下命令，首先查看当前nginx的版本及模块，复制configure arguments准备下次重新编译使用。

nginx -V

----------------------------------------------------------------------------

nginx version: nginx/1.16.1

built by gcc 4.4.7 20120313 (Red Hat 4.4.7-18) (GCC)

built with OpenSSL 1.0.1e 22 Sep 2013

TLS SNI support enabled

configure arguments: --prefix=/usr/local/nginx --with-pcre=/ywj/src/pcre-8.35 --with-http_ssl_module --with-http_realip_module --with-http_addition_module --with-http_gzip_static_module --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_stub_status_module --without-http_charset_module --with-http_v2_module

2、其次，重新配置模块并重新编译nginx文件，具体操作如下：

例如：进入nginx源代码路径，执行

./configure –prefix=/usr/nginx –with-pcre=/root/pcre-8.20 –with-zlib=/root/zlib-1.2.11 –with-http_stub_status_module –with-http_ssl_module –with-http_realip_module –with-stream –with-openssl=/opt/openssl-1.0.1u

make

3、替换原来的nginx为新版本的

#先备份

mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx20181113.old

#再复制最新nginx

cp ./objs/nginx /usr/local/nginx/sbin/nginx

#查看最新版本 nginx –V

查看nginx是否运行

ps -ef | grep nginx

netstat -taunlp | grep :80

netstat -ntlp //查看当前所有tcp端口

netstat -ntulp | grep 80 //查看所有80端口使用情况