用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-nginx-v300-2-3-2命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | cis-nginx-v300-2-3-2 |
| description | Ensure access to NGINX directories and files is restricted (Manual) |
| category | cis-nginx |
| version | 3.0 |
| author | cyberstrike-official |
| tags | ["cis","nginx","web-server","reverse-proxy","permissions-ownership","basic-configuration"] |
| cis_id | 2.3.2 |
| cis_benchmark | CIS NGINX Benchmark v3.0.0 |
| tech_stack | ["nginx","linux","web-server"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
The NGINX configuration directory (/etc/nginx or equivalent) and its contents should have restrictive permissions to enforce the principle of least privilege.
root user and the root group (and potentially read/execute by the group), but not by others.root and readable by the group, but inaccessible to others.Restrictive file permissions prevent unauthorized users on the system from viewing sensitive configuration details, such as backend IP addresses, routing logic, or loaded module paths. By removing "world" access (permissions for "other"), we ensure that only administrators (via sudo) can interact with the web server configuration. This is a fundamental defense against information disclosure.
Setting permissions to 640 (files) and 750 (directories) prevents non-privileged users from listing the configuration directory or reading configuration files.
1. Identify Configuration Directory:
Run nginx -V and identify the --conf-path to determine the configuration root (e.g., /etc/nginx).
2. Audit Directory Permissions:
Run the following command to find directories with loose permissions:
find /etc/nginx -type d -exec stat -Lc "%n %a" {} +
Evaluation:
Verify that the output shows permissions of 750 (drwxr-x---) or more restrictive (e.g., 700).
755 (drwxr-xr-x) allows world read/execute.750 or 700.3. Audit File Permissions:
Run the following command to find files with loose permissions:
find /etc/nginx -type f -exec stat -Lc "%n %a" {} +
Evaluation:
Verify that the output shows permissions of 640 (-rw-r-----) or more restrictive (e.g., 600).
644 (-rw-r--r--) allows world read.640 or 600.To restrict access to the NGINX configuration directory and files, execute the following commands:
1. Restrict Directories (750):
Allow owner (root) full access, group read/execute, deny others.
find /etc/nginx -type d -exec chmod 750 {} +
2. Restrict Files (640):
Allow owner (root) read/write, group read, deny others.
find /etc/nginx -type f -exec chmod 640 {} +
Note: Private keys (e.g., .key files) require even stricter permissions (400 or 600) and should be addressed separately or manually verified here.
Default permissions are typically 755 for directories and 644 for files (world-readable).
Critical: If your NGINX setup relies on the worker process (nginx user) reading configuration files directly (uncommon for standard configs, but possible with certain includes or SSL certificates not handled by the master process), ensure the nginx user is in the group that owns the files, OR use chmod 644 if absolutely necessary. However, the Master Process (root) handles parsing, so 640/root:root is usually safe.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 3.3 Configure Data Access Control Lists | Y | Y | Y |
| v7 | 14.6 Protect Information through Access Control Lists | Y | Y | Y |
| Tactic | Technique |
|---|---|
| Persistence | T1222 - File and Directory Permissions Modification |