Home / ubuntu / Questions

Questions[nginx](ubuntu)

Martin Hope
muru
Asked: 2014-11-27 23:40:14 +0800 CST
  • 88

nginx on Ubuntu is a virtual package provided by one of five packages from the official repositories (at least as of 14.04, defaulting to nginx-core, I believe):

$ apt-cache depends nginx | tail -n+2 | cut -d: -f 2 | sort -u
 nginx-core
 nginx-extras
 nginx-full
 nginx-light
 nginx-naxsi

What is the difference between these packages and what are the recommended use cases for them?

This somewhat old Debian Wiki page has a feature comparison between extras, full, light and naxsi, but no mention is made of core. How much of it has changed in 14.04?

secondary As I understand it, nginx doesn't support runtime enabling of modules like Apache does, so would installing nginx-extras impact performance?

nginx
Martin Hope
Jo Liss
Asked: 2012-04-06 09:35:39 +0800 CST
  • 32

Concrete issue: The Oneiric nginx package is at version 1.0.5-1, released in July 2011 according to the changelog.

The recent memory-disclosure vulnerability (advisory page, CVE-2012-1180, DSA-2434-1) isn't fixed in 1.0.5-1. If I'm not misreading the Ubuntu CVE page, all Ubuntu versions seem to ship a vulnerable nginx.

  1. Is this true?

    If so: I thought there was a security team at Canonical that's actively working on issues like this, so I expected to get a security update within a short timeframe (hours or days) through apt-get update.

  2. Is this expectation -- that keeping my packages up-to-date is enough to stop my server from having known vulnerabilities -- generally wrong?

  3. If so: What should I do to keep it secure? Reading the Ubuntu security notices wouldn't have helped in this case, as the nginx vulnerability was never posted there.

security nginx
Martin Hope
Jonas
Asked: 2010-10-26 07:22:45 +0800 CST
  • 67

I use Ubuntu Server 10.10 and have installed Nginx web server with apt-get install nginx. It creates a default web page at /var/www/nginx-default/ and that directory has the permissions drwxr-xr-x 2 root root.

When I access the default site on http://localhost/ I get this message on the page 403 Forbidden.

How should I set the file permissions on the www root so I can secure access the web pages? Or is there something else that I have to change?

nginx