Auditing and Hardening nginx on a VPS: The Routine That Beats the Next Advisory

# The binary
nginx -v

# What the package manager believes
apt list --installed 2>/dev/null | grep nginx || rpm -q nginx

# What is actually running, and for how long
ps -eo pid,lstart,cmd | grep "[n]ginx: master"

# nginx inside running containers
docker ps --format '{{.Names}}' | while read -r c; do
  v=$(docker exec "$c" nginx -v 2>&1 | grep -o 'nginx/[0-9.]*' || true)
  [ -n "$v" ] && echo "$c: $v"
done

# Pinned tags in your compose files
grep -rn "image:.*nginx" --include="*.yml" --include="*.yaml" . 2>/dev/null

# Full build configuration, including every module compiled in
nginx -V 2>&1 | tr ' ' '\n' | grep -E "^--with|^--without"

# Regex-based map blocks
grep -rn "^\s*map\s" /etc/nginx/ -A 3 | grep -E "~\*?\s"

# rewrite rules and regex captures
grep -rnE "^\s*rewrite\s|\\\$[1-9]" /etc/nginx/

# In the http block
server_tokens off;

curl -sI https://example.com | grep -i "^server:"
# expected: "Server: nginx" with no version

# In the server block
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

# In the http block
client_max_body_size 10m;
client_body_timeout 12s;
client_header_timeout 12s;

# A modest rate limit zone, applied where it makes sense
limit_req_zone $binary_remote_addr zone=basic:10m rate=10r/s;

# In the location that needs it — a login endpoint, for instance
location /login {
    limit_req zone=basic burst=20 nodelay;
}

# Parse and validate without touching the running server
sudo nginx -t

# Only if that passed
sudo systemctl reload nginx

#!/usr/bin/env bash
# nginx-audit.sh — run monthly, or after any advisory
set -u
echo "== version =="
nginx -v 2>&1
echo "== master process uptime =="
ps -eo lstart,cmd | grep "[n]ginx: master" || echo "not running"
echo "== config validity =="
nginx -t 2>&1 | tail -2
echo "== version leak =="
grep -rq "server_tokens off" /etc/nginx/ && echo "server_tokens off" || echo "WARNING: version exposed"
echo "== containers =="
docker ps --format '{{.Names}}' 2>/dev/null | while read -r c; do
  v=$(docker exec "$c" nginx -v 2>&1 | grep -o 'nginx/[0-9.]*' || true)
  [ -n "$v" ] && echo "$c: $v"
done

chmod +x nginx-audit.sh && ./nginx-audit.sh