NGINX inspection method, equipment, medium and program product

Abstract

The invention discloses an NGINX inspection method and device, a medium and a program product. The method comprises the following steps: firstly, obtaining NGINX service data; and based on an OPA engine, according to the inspection item and the service data, performing inspection processing on the NGINX to obtain an inspection result. According to the embodiment of the invention, routing inspection is carried out in NGINX service operation, the routing inspection requirements of different versions of NGINX and different routing inspection items can be met only by extending the routing inspection item library by operation and maintenance personnel, self-defined routing inspection is realized, enterprises can be helped to save a large amount of capital and labor cost, the working efficiency is effectively improved, and high expandability is achieved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an NGINX inspection method, equipment, medium and program product. Background Art

[0002] NGINX is an HTTP web server that supports reverse proxy, content caching, load balancing, TCP / UDP proxy, and mail service proxy. When using NGINX, security baseline configuration checks and timely repair of CVE (Common Vulnerabilities and Exposures) are important steps for the safe and stable operation of NGINX, and are also one of the important links in the operation and maintenance guarantee system.

[0003] Different versions of NGINX services are often running in enterprise production environments. The security baseline configurations of different versions of NGINX services are different. At the same time, the CVE vulnerabilities of different versions are also different, and new CVE vulnerabilities continue to emerge.

[0004] Security baseline configuration checks or CVE vulnerability repairs for NGINX services are generally implemented through inspection mechanisms. Existing inspections for NGINX service baseline configurations are basically done by using the NGINX-t command that comes with NGINX to perform syntax checks before NGINX runs, or by writing operation and maintenance scripts to implement inspections, or by using F5's commercial product NGINXInstance Manager. Existing technologies cannot implement inspections of NGINX services in operation and cannot implement inspections based on custom inspection items.

[0005] In summary, the existing NGINX inspection methods have the following problems and defects: (1) The existing NGINX inspection methods cannot implement inspections while the NGINX service is running; (2) The existing NGINX inspection methods have poor scalability and do not support the execution of customized inspection items, inspections of different versions of NGINX services, and the output of inspection reports; (3) Commercial products are relatively expensive, have high maintenance costs, and are difficult to implement customized development.

[0006] Therefore, it is urgent to invent an NGINX inspection method to solve the problems that the existing NGINX inspection technology cannot perform inspections during service operation, has poor scalability and high cost. Summary of the invention

[0007] In view of this, an embodiment of the present invention provides an NGINX inspection method, device, medium and program product, which at least partially solve the problems existing in the prior art.

[0008] Other features and advantages of the present invention will become apparent from the following detailed description, or may be learned in part by practice of the present invention.

[0009] In order to achieve the above purpose, the embodiment of the present invention provides the following technical solutions:

[0010] According to a first aspect of an embodiment of the present invention, there is provided an NGINX inspection method, characterized in that the method comprises:

[0011] Get NGINX service data;

[0012] Based on the OPA engine, NGINX is inspected according to the inspection items and the service data to obtain the inspection results.

[0013] Furthermore, the service data is a configuration file of NGINX.

[0014] Furthermore, based on the OPA engine, NGINX is inspected according to the inspection items and the service data to obtain inspection results, including:

[0015] Based on the OPA engine, a baseline configuration inspection is performed on NGINX according to the inspection items and the configuration file to obtain a baseline configuration inspection result, wherein the inspection items are defined in the Rego language.

[0016] Furthermore, based on the OPA engine, according to the inspection items and the configuration file, a baseline configuration inspection is performed on NGINX to obtain a baseline configuration inspection result, including:

[0017] Use the NGINX native command nginx-t to perform a syntax check on the configuration file to obtain a configuration file that has been checked;

[0018] The configuration file after the inspection is converted into JSON format to obtain a JSON configuration file;

[0019] Determine whether there are custom configuration inspection items;

[0020] If there is a custom configuration inspection item, the custom configuration inspection item is merged with the existing configuration inspection item to obtain a configuration inspection item library;

[0021] If there is no custom configuration inspection item, use the existing configuration inspection items to generate a configuration inspection item library;

[0022] Using the OPA client, instantiate the JSON configuration file and the configuration inspection item library to obtain a baseline inspection strategy;

[0023] Calling the OPA engine to execute the baseline inspection strategy and obtain a first strategy execution result;

[0024] The execution result of the first strategy is formatted and outputted to obtain a baseline inspection result.

[0025] Furthermore, the service data is NGINX instance version information.

[0026] Furthermore, based on the OPA engine, NGINX is inspected according to the inspection items and the service data to obtain inspection results, including:

[0027] Based on the OPA engine, according to the inspection items and the NGINX instance version information, a CVE vulnerability inspection is performed on NGINX to obtain a CVE vulnerability inspection result, where the inspection items are defined in the Rego language.

[0028] Furthermore, based on the OPA engine, according to the inspection items and the NGINX instance version information, a CVE vulnerability inspection is performed on NGINX to obtain a CVE vulnerability inspection result, including:

[0029] Get the latest CVE vulnerability file for NGINX service;

[0030] Perform JSON format conversion on the NGINX instance version information and the CVE vulnerability file to obtain JSON instance version information and a JSON vulnerability file;

[0031] Determine whether there are custom CVE inspection items;

[0032] If there is a custom CVE inspection item, the custom CVE inspection item is merged with the existing CVE inspection item to obtain a CVE inspection item library;

[0033] If there is no custom CVE inspection item, use the existing CVE inspection items to generate a CVE inspection item library;

[0034] Using the OPA client, instantiate the JSON instance version information, the JSON vulnerability file, and the CVE inspection item library to obtain a CVE vulnerability inspection strategy;

[0035] Call the OPA engine to execute the CVE vulnerability inspection strategy and obtain a second strategy execution result;

[0036] The execution result of the second strategy is formatted and output to obtain a CVE vulnerability inspection result.

[0037] According to a second aspect of an embodiment of the present invention, a device is provided, the device comprising: a processor and a memory;

[0038] The memory is used to store one or more program instructions;

[0039] The processor is used to run one or more program instructions to execute the steps of an NGINX inspection method as described in any of the above items.

[0040] According to a third aspect of an embodiment of the present invention, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of an NGINX inspection method as described in any one of the above items are implemented.

[0041] According to a fourth aspect of an embodiment of the present invention, a computer program product is provided, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, which, when executed by a computer, enable the computer to implement the steps of an NGINX inspection method as described in any one of the above items.

[0042] The embodiments of the present invention provide an NGINX inspection method, device, medium and program product, which realize inspection during NGINX service operation. In addition, for different versions of NGINX and different inspection items, operation and maintenance personnel only need to expand the inspection item library Regolibrary, which fully meets the enterprise's customized inspection needs, can help enterprises save a lot of funds and labor costs, greatly improve work efficiency, and have high scalability. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the implementation methods of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the implementation methods or the description of the prior art. Obviously, the drawings in the following description are only exemplary, and for ordinary technicians in this field, other implementation drawings can be derived from the provided drawings without creative work.

[0044] Figure 1 A flowchart of an NGINX inspection method provided by an embodiment of the present invention;

[0045] Figure 2 A schematic block diagram of the process of baseline configuration inspection provided by an embodiment of the present invention;

[0046] Figure 3 A schematic diagram of the CVE vulnerability inspection process provided by an embodiment of the present invention;

[0047] Figure 4 An architectural diagram of an inspection system based on the NGINX inspection method is provided for an embodiment of the present invention. DETAILED DESCRIPTION

[0048] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0049] In addition, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus that includes a series of steps or elements is not necessarily limited to those steps or elements explicitly listed, but may include other steps or elements not explicitly listed or inherent to such process, method, product, or apparatus.

[0050] Figure 1 The figure shows a flow chart of an NGINX inspection method according to an embodiment of the present invention.

[0051] like Figure 1 As shown, the NGINX inspection method according to an embodiment of the present invention may include step S100 and step S200.

[0052] In step S100, the service data of NGINX is obtained.

[0053] Specifically, the above steps include:

[0054] Get NGINX service data, which includes NGINX configuration files and NGINX instance version information.

[0055] In step S200, based on the OPA engine, NGINX is inspected according to the inspection items and service data to obtain the inspection results.

[0056] Specifically, the above steps include:

[0057] Baseline configuration inspection:

[0058] refer to Figure 2 Based on the OPA (Open Policy Agent, an open source universal policy engine that enables unified, context-aware policy control across the entire stack) engine, NGINX performs a baseline configuration inspection based on inspection items and configuration files, and obtains the baseline configuration inspection results, including:

[0059] First, use the NGINX native command nginx-t to perform a syntax check on the configuration file to check whether there are any syntax errors and obtain the checked configuration file.

[0060] Then, the configuration file after the above check is converted into JSON format to obtain a JSON configuration file.

[0061] Then determine whether there are custom configuration inspection items, that is, whether the user has customized new inspection items for this inspection. The above inspection items are defined in Rego language. Rego is an advanced declarative language and the policy declaration language used by OPA. Rego provides a structured and highly readable language for defining policies, allowing policy makers to focus on querying the returned content without paying attention to how to execute the query.

[0062] If there are custom configuration inspection items, the custom configuration inspection items are merged with the built-in existing configuration inspection items to obtain a configuration inspection item library.

[0063] If there is no custom configuration inspection item, the existing configuration inspection items are used to generate a configuration inspection item library.

[0064] Then, the JSON configuration file and the configuration inspection item library are passed to the OPA client, and the JSON configuration file and the configuration inspection item library are instantiated using the OPA client to obtain a baseline inspection strategy.

[0065] Finally, the OPA engine is called in the OPA client to execute the above baseline inspection policy and obtain the first policy execution result, which is true or false.

[0066] CVE vulnerability inspection:

[0067] refer to Figure 3 Based on the OPA engine, perform a CVE vulnerability inspection on NGINX according to the inspection items and NGINX instance version information, and obtain the CVE vulnerability inspection results, including:

[0068] First, obtain the latest CVE vulnerability file for the NGINX service from NGINX official website.

[0069] Convert the NGINX instance version information and CVE vulnerability file into JSON format to obtain JSON instance version information and JSON vulnerability file, and use the JSON vulnerability file as reference data for policy decision-making.

[0070] Then determine whether there are custom CVE inspection items, that is, whether the user has customized new inspection items for this CVE vulnerability inspection. The above inspection items are defined using the Rego language.

[0071] If there are custom CVE inspection items, the custom CVE inspection items are merged with the existing CVE inspection items to obtain a CVE inspection item library.

[0072] If there are no custom CVE inspection items, the built-in existing CVE inspection items are used to generate a CVE inspection item library.

[0073] The above JSON instance version information, the above CVE inspection item library and the JSON vulnerability file are passed to the OPA client. The OPA client is used to instantiate the JSON instance version information, the JSON vulnerability file and the CVE inspection item library to obtain the CVE vulnerability inspection strategy.

[0074] The OPA client calls the OPA engine to execute the CVE vulnerability inspection policy and obtains the second policy execution result.

[0075] Finally, the execution result of the second strategy is formatted and outputted to obtain the CVE vulnerability inspection result, which is true or false.

[0076] In addition, based on an NGINX inspection method provided in an embodiment of the present invention, an NGINX inspection system (NGINX Server Detector) is also provided. The system architecture is as follows: Figure 4 shown.

[0077] refer to Figure 4 The system input is the NGINX configuration file (Config) and instance version information (Version). The data parsing module (ParameterParse) is used to preprocess the input data. The OPA engine (OPA Engine) is used to obtain the policy execution results based on the input configuration file and instance version information, combined with the configuration inspection item library (NGINX Config Regolibrary) and the CVE inspection item library (NGINX CVE Regolibrary). Finally, the output format module (OutputFormatter) is used to format the output and obtain the inspection results in JSON format.

[0078] In addition, an embodiment of the present invention also provides a device, which includes: a processor and a memory; the memory is used to store one or more program instructions; the processor is used to run one or more program instructions to execute the steps of an NGINX inspection method as described above.

[0079] In addition, an embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the NGINX inspection method described above are implemented.

[0080] In addition, an embodiment of the present invention further provides a computer program product, which includes computer program instructions, and when the computer program instructions are executed by a processor, the steps of the NGINX inspection method described above are implemented.

[0081] The embodiments of the present invention provide an NGINX inspection method, device, medium and program product, which realize inspection during NGINX service operation. In addition, for different versions of NGINX and different inspection items, operation and maintenance personnel only need to expand the inspection item library Regolibrary, which fully meets the enterprise's customized inspection needs, can help enterprises save a lot of funds and labor costs, greatly improve work efficiency, and have high scalability.

[0082] In addition, the embodiments of the present invention can also be used for configuration checking and defect checking before the NGINX service is running to reduce security risks during operation.

[0083] In the embodiment of the present invention, the processor may be an integrated circuit chip having the ability to process signals. The processor may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gates or transistor logic devices, or discrete hardware components. The methods, steps, and logic block diagrams disclosed in the embodiments of the present invention may be implemented or executed. The general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present invention may be directly embodied as being executed by a hardware decoding processor, or may be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a mature storage medium in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The processor reads the information in the storage medium and completes the steps of the above method in combination with its hardware. The storage medium may be a memory, for example, a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct RAM bus random access memory (DRRAM).The storage medium described in the embodiment of the present invention is intended to include but is not limited to these and any other suitable types of memory. Those skilled in the art should be aware that in one or more of the above examples, the functions described in the present invention can be implemented by a combination of hardware and software. When the software is applied, the corresponding function can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein the communication medium includes any medium that is convenient for transmitting a computer program from one place to another. The storage medium can be any available medium that a general or special-purpose computer can access. Although the present invention has been described in detail above with general descriptions and specific embodiments, it is obvious to those skilled in the art that some modifications or improvements can be made to it on the basis of the present invention. Therefore, these modifications or improvements made on the basis of not departing from the spirit of the present invention all belong to the scope of protection claimed in the present invention.

[0084] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Those skilled in the art may make some simple modifications, equivalent changes or modifications using the technical contents disclosed above, which all fall within the protection scope of the present invention.

Claims

1. An NGINX inspection method, characterized in that: The method comprises: Get NGINX service data; Based on the OPA engine, NGINX is inspected according to the inspection items and the service data to obtain the inspection results.

2. According to the NGINX inspection method of claim 1, it is characterized in that: The service data is the configuration file of NGINX.

3. An NGINX inspection method according to claim 2, characterized in that: Based on the OPA engine, NGINX is inspected according to the inspection items and the service data to obtain inspection results, including: Based on the OPA engine, a baseline configuration inspection is performed on NGINX according to the inspection items and the configuration file to obtain a baseline configuration inspection result, wherein the inspection items are defined in the Rego language.

4. The NGINX inspection method according to claim 3, characterized in that: Based on the OPA engine, perform a baseline configuration inspection on NGINX according to the inspection items and the configuration file, and obtain the baseline configuration inspection results, including: Use the NGINX native command nginx-t to perform a syntax check on the configuration file to obtain a configuration file that has been checked; The configuration file after the inspection is converted into JSON format to obtain a JSON configuration file; Determine whether there are custom configuration inspection items; If there is a custom configuration inspection item, the custom configuration inspection item is merged with the existing configuration inspection item to obtain a configuration inspection item library; If there is no custom configuration inspection item, use the existing configuration inspection items to generate a configuration inspection item library; Using the OPA client, instantiate the JSON configuration file and the configuration inspection item library to obtain a baseline inspection strategy; Calling the OPA engine to execute the baseline inspection strategy and obtain a first strategy execution result; The execution result of the first strategy is formatted and outputted to obtain a baseline inspection result.

5. The NGINX inspection method according to claim 1, characterized in that: The service data is NGINX instance version information.

6. The NGINX inspection method according to claim 5, characterized in that: Based on the OPA engine, NGINX is inspected according to the inspection items and the service data to obtain inspection results, including: Based on the OPA engine, according to the inspection items and the NGINX instance version information, a CVE vulnerability inspection is performed on NGINX to obtain a CVE vulnerability inspection result, where the inspection items are defined in the Rego language.

7. The NGINX inspection method according to claim 6, characterized in that: Based on the OPA engine, according to the inspection items and the NGINX instance version information, a CVE vulnerability inspection is performed on NGINX to obtain the CVE vulnerability inspection results, including: Get the latest CVE vulnerability file for NGINX service; Perform JSON format conversion on the NGINX instance version information and the CVE vulnerability file to obtain JSON instance version information and a JSON vulnerability file; Determine whether there are custom CVE inspection items; If there is a custom CVE inspection item, the custom CVE inspection item is merged with the existing CVE inspection item to obtain a CVE inspection item library; If there is no custom CVE inspection item, use the existing CVE inspection items to generate a CVE inspection item library; Using the OPA client, instantiate the JSON instance version information, the JSON vulnerability file, and the CVE inspection item library to obtain a CVE vulnerability inspection strategy; Call the OPA engine to execute the CVE vulnerability inspection strategy and obtain a second strategy execution result; The execution result of the second strategy is formatted and output to obtain a CVE vulnerability inspection result.

8. An NGINX inspection device, characterized in that: The device comprises: a processor and a memory; The memory is used to store one or more program instructions; The processor is used to run one or more program instructions to execute the steps of an NGINX inspection method as described in any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, the steps of an NGINX inspection method as described in any one of claims 1 to 7 are implemented.

10. A computer program product, characterized in that The computer program product includes computer program instructions, which, when executed by a processor, implement the steps of an NGINX inspection method as described in any one of claims 1 to 7.

Images