用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-nginx-v300-3-4命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | cis-nginx-v300-3-4 |
| description | Ensure proxies pass source IP information (Manual) |
| category | cis-nginx |
| version | 3.0 |
| author | cyberstrike-official |
| tags | ["cis","nginx","web-server","reverse-proxy","logging"] |
| cis_id | 3.4 |
| cis_benchmark | CIS NGINX Benchmark v3.0.0 |
| tech_stack | ["nginx","linux","web-server"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
When NGINX acts as a reverse proxy or load balancer, it terminates the client connection and opens a new connection to the upstream application server. By default, the upstream server sees the NGINX server's internal IP address as the source, obscuring the original client IP. Standard HTTP headers like X-Forwarded-For and X-Real-IP must be explicitly configured to pass the original client's IP address and protocol information to the backend application.
Visibility of the true client IP address is essential for security auditing, incident response, and access control within the backend application. Without forwarding this information:
Enabling these headers allows the backend application to see the original client IP. However, if NGINX simply appends to an existing X-Forwarded-For header sent by a malicious client, the backend might be tricked into trusting a spoofed IP at the beginning of the list.
1. Verify Configuration:
Check the active configuration for proxy header directives in proxied locations:
nginx -T 2>/dev/null | grep -E "proxy_set_header (X-Real-IP|X-Forwarded-For)"
Evaluation:
proxy_set_header X-Forwarded-For and proxy_set_header X-Real-IP are present in location blocks that use proxy_pass (or grpc_pass, fastcgi_pass).X-Forwarded-For should typically use $proxy_add_x_forwarded_for (to preserve the chain) or $remote_addr (if NGINX is the first trusted hop).X-Real-IP should use .$remote_addrConfigure NGINX to forward client IP information in your server or location blocks where proxy_pass is used.
Configuration Example:
location / {
# Use 'https' for Zero Trust environments (requires proxy_ssl_verify configuration)
# Use 'http' for standard TLS offloading (upstream traffic is unencrypted)
proxy_pass <protocol>://example_backend_application;
# Standard header: Appends the client IP to the list of proxies
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# NGINX-specific header: Sets the direct client IP (useful for apps expecting a single value)
proxy_set_header X-Real-IP $remote_addr;
# Recommended: Forward the protocol (http vs https)
proxy_set_header X-Forwarded-Proto $scheme;
}
By default, NGINX does not add these headers. The upstream server receives requests appearing to originate from the NGINX server's IP address.
Privacy: Users' privacy should be considered when forwarding client IP addresses. Ensure your organization's privacy policy discloses the collection and processing of IP address information.
Security Trust: Any information in the X-Forwarded-For header supplied by the client (before reaching your trusted infrastructure) is untrusted and can be easily spoofed. Backend applications and security controls (like rate limiting) must be configured to trust only the IPs appended by your own NGINX instance or known trusted proxies, ignoring the client-supplied part of the chain.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 8.11 Conduct Audit Log Reviews | N | Y | Y |
| v7 | 6.7 Regularly Review Logs | N | Y | Y |
| Tactic | Technique |
|---|---|
| Defense Evasion | T1070 - Indicator Removal |
| Command and Control | T1090 - Proxy |