mirror of
https://github.com/NginxProxyManager/nginx-proxy-manager.git
synced 2026-11-10 12:28:28 +00:00
Jamie Curnow
5b7e34eb67
Security - Check advanced_config permissions before creating a certificate on host update (proxy, redirection and 404 hosts). A refused request previously requested a Let's Encrypt certificate first, leaving an orphan certificate and using up rate limit. - Only trust X-NPM-Peer-Addr when it comes with a secret generated at container start. The admin nginx sends both headers. Any proxy host or stream forwarding to 127.0.0.1:3000 was also a loopback peer, so it could forge the header and get a fresh rate-limit bucket on every request. Without the secret (dev, or a mounted production.conf), the header is ignored. - Add a login limit per IP across all accounts (30 failed attempts a minute) alongside the per-account one. Before this, one address could spray passwords over any number of accounts. Behind a shared proxy, everyone using that proxy shares this limit. - Stop trusting X-Real-IP from loopback. It was only there for an older version of the rate limiter, and it let a stream host forwarding to a local proxy host forge the client IP and get past IP access lists. Loopback now behaves as it does on master. Correctness - Refuse to delete a certificate that hosts still use (400, with counts per host type). Their configs include its files, and a successful revoke deleted them anyway, which broke nginx -t. Otherwise the certificate is revoked and its files are removed even if the revoke fails. - Let non-admins clear a location's advanced config. Deleting the location was already allowed and has the same effect, and a location deleted and re-added at the same path arrives with an empty config, which was refused. - Clear proxy host grants (meta.proxy_host_ids) when visibility isn't "user" or proxy hosts are hidden, and drop ids of deleted hosts. Before, hidden grants came back when proxy hosts were shown again. The backend enforces this; the permissions modal also stops sending them. - 404 host and redirection host modals now wait for the current user to load, so an admin's advanced config change isn't dropped if they submit before it loads. Tests - NonAdminHosts.cy.js: refused change doesn't create a certificate, location rename and clear rules, grant clearing. - Certificates.cy.js: deleting a certificate that is in use.
42 lines
1.5 KiB
Bash
42 lines
1.5 KiB
Bash
#!/command/with-contenv bash
|
|
# shellcheck shell=bash
|
|
|
|
# This command reads the `NPM_ADMIN_PORT` env var and will fall
|
|
# back to 81 if this is not set or is not a number.
|
|
|
|
set -e
|
|
|
|
log_info 'Admin Port ...'
|
|
|
|
NPM_ADMIN_PORT="${NPM_ADMIN_PORT:-81}"
|
|
# ensure admin port is a number
|
|
if ! [[ "$NPM_ADMIN_PORT" =~ ^[0-9]+$ ]]; then
|
|
echo "WARNING: NPM_ADMIN_PORT must be a number. Defaulting to 81" >&2
|
|
NPM_ADMIN_PORT=81
|
|
fi
|
|
|
|
PRODFILE="/etc/nginx/conf.d/production.conf"
|
|
|
|
# A new secret on every start. The admin nginx sends it with X-NPM-Peer-Addr, and the backend
|
|
# only trusts that header when the secret matches, so a proxy host or stream forwarding to the
|
|
# backend port can't pass a forged one through.
|
|
NPM_PEER_SECRET="$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n')"
|
|
if [ "${#NPM_PEER_SECRET}" -ne 64 ]; then
|
|
log_fatal "Failed to generate the backend peer secret"
|
|
fi
|
|
|
|
SED_REGEX="s/\{\{NPM_ADMIN_PORT\}\}/${NPM_ADMIN_PORT}/g;s/\{\{NPM_PEER_SECRET\}\}/${NPM_PEER_SECRET}/g"
|
|
|
|
if is_mounted "$PRODFILE"; then
|
|
echo "WARNING: skipping ${PRODFILE} — mounted file" >&2
|
|
elif [ -f "$PRODFILE.template" ]; then
|
|
if sed -E "$SED_REGEX" "$PRODFILE.template" > "$PRODFILE" && [ -s "$PRODFILE" ]; then
|
|
# success
|
|
log_info "Generated ${PRODFILE} from template"
|
|
# Hand the secret to the backend; with-contenv loads this directory into its environment
|
|
printf '%s' "$NPM_PEER_SECRET" > /var/run/s6/container_environment/NPM_PEER_SECRET
|
|
else
|
|
log_fatal "Failed to generate ${PRODFILE} from template"
|
|
fi
|
|
fi
|