Improve nginx configuration security
To address from #17 (closed):
-
GHT-003 Outdated TLS support: https://www.ssllabs.com/ssltest/analyze.html?d=learn.totem%2dproject.org&latest -
The server supports TLS 1.0 and 1.1, support for this should be removed. - Check https://ssl-config.mozilla.org/ for a secure nginx config
-
-
GHT-014 Django interface should be behind firewall https://code.greenhost.net/greenhost/ansible/-/issues/163 -
learn.totem-project.org/admin should only be available from certain IP addresses
-
-
GHT-017 -- when applying better nginx configuration for GHT-003 make sure not to support Cipher Block Chaining (CBC) encryption. (not sure if this is currently still the case) -
GHT-018 Insufficient content sniffing protection #33 (closed)(?) -
Ensure that responses contain a X-Content-Type-Options HTTP header with the value nosnifff
-
Header improvements:
-
Add HSTS header to nginx configuration (probably with Tutor plugin) -
Add X-Content-Type-Options
header (If possible with edx) -
Add X-XSS-Protection
header (if possible with edx)- Ensure that responses contain a
X-XSS-Protection
HTTP header with the value1; mode=block
- Ensure that responses contain a
And unless it's fixed in greenhost/ansible#163, we also need to address: