beginner · hardening · 150 points · 0 working it

Hardening an nginx Config

You inherited a public-facing nginx config with the common gaps. Identify each weakness and name the directive or value that fixes it.

Stop leaking the version
```
server {
  listen 443 ssl;
  server_tokens on;   # default prints version on error pages + Server header
}
```
An attacker fingerprints your version and matches it against known CVEs. The directive that disables this is the checkpoint — just the directive name.
Which directive disables version disclosure? (name only)
Hint
Two words, starts with server_.
Sign in to verify this checkpoint.
Block clickjacking
Without a framing policy your app can be iframed by a hostile page and trick users into clicks they never meant to send. You add:
```
add_header X-Frame-Options "SAMEORIGIN" always;
```
Which response header blocks your site being framed? (the header name)
Hint
Three words joined by hyphens.
Sign in to verify this checkpoint.
Rate-limit the login endpoint
```
limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;
location /login { limit_req zone=login burst=3; }
```
The zone key controls what limit_req counts. The exact zone key used above (with its leading $) is the checkpoint.
What variable keys the rate-limit zone per client IP?
Hint
The binary form of the remote address variable.
Sign in to verify this checkpoint.