系統(tǒng)：
linux/centos6.5
nginx版本openresty/1.13.6.2
漏洞描述
http://mailman.nginx.org/pipermail/nginx-announce/2018/000220.html
Hello!
Two security issues were identified in nginx HTTP/2 implementation,
which might cause excessive memory consumption (CVE-2018-16843)
and CPU usage (CVE-2018-16844).
The issues affect nginx compiled with the ngx_http_v2_module (not
compiled by default) if the "http2" option of the "listen" directive is
used in a configuration file.
The issues affect nginx 1.9.5 - 1.15.5.
#nginx1.15.6,1.14.1修復(fù)了該問題
The issues are fixed in nginx 1.15.6, 1.14.1.
Thanks to Gal Goldshtein from F5 Networks for initial report of the CPU
usage issue.
.
為什么選擇重新安裝nginx鹦聪？
openresty官網(wǎng)最新的穩(wěn)定版本是1.13.6.2汁掠，盡管它推出了一個(gè)最新測(cè)試版1.15.8.1 RC1角骤，考慮到穩(wěn)定因素并且nginx配置中也基本沒有特殊的場(chǎng)景需要用到Lua,最后我選擇安裝原生的nginx黑低。
1. 下載
cd /home
#下載nginx 1.14.2
wget http://nginx.org/download/nginx-1.14.2.tar.gz
#解壓
tar -xzf nginx-1.14.2.tar.gz
2. 編譯安裝
/home/nginx-1.14.2/configure --prefix=/usr/local/nginx
--with-http_stub_status_module
--without-http_fastcgi_module
--without-http_upstream_ip_hash_module
--without-http_autoindex_module
--without-http_ssi_module
--without-mail_pop3_module
--without-mail_imap_module --without-mail_smtp_module
--without-http_uwsgi_module --without-http_scgi_module
--without-http_memcached_module
#編譯
make
#安裝
make install
接下來拷貝openresty中配置文件及SSL認(rèn)證證書
cp -r /usr/local/openresty/nginx/conf/nginx.conf /usr/local/nginx/conf
...
檢查nginx配置文件是否正確
/usr/local/nginx/sbin/nginx -t
nginx: [emerg] unknown directive "ssl" in /usr/local/nginx/conf/nginx.conf:181
nginx: configuration file /usr/local/nginx/conf/nginx.conf test failed
上面這個(gè)問題是我們?cè)诰幾g的時(shí)候少加了--with-http_ssl_module模塊，我們需要把這個(gè)模塊編譯進(jìn)去匾七。
/home/nginx-1.14.2/configure --prefix=/usr/local/nginx
--with-http_ssl_module
#只編譯不需要install
make
#然后又報(bào)錯(cuò)啦Ｅト取４朴纭杯聚！
/home/nginx-1.14.2/src/event/ngx_event_openssl.c:3397: undefined reference to `SSL_CIPHER_find'
/home/nginx-1.14.2/src/event/ngx_event_openssl.c:3417: undefined reference to `SSL_CIPHER_find'
objs/src/event/ngx_event_openssl.o: In function `ngx_ssl_check_host':
/home/nginx-1.14.2/src/event/ngx_event_openssl.c:3208: undefined reference to `X509_check_host'
objs/src/event/ngx_event_openssl.o: In function `ngx_ssl_handshake':
/home/nginx-1.14.2/src/event/ngx_event_openssl.c:1314: undefined reference to `SSL_is_server'
objs/src/event/ngx_event_openssl.o: In function `ngx_ssl_info_callback':
/home/nginx-1.14.2/src/event/ngx_event_openssl.c:851: undefined reference to `SSL_is_server'
objs/src/http/modules/ngx_http_ssl_module.o: In function `ngx_http_ssl_merge_srv_conf':
/home/nginx-1.14.2/src/http/modules/ngx_http_ssl_module.c:695: undefined reference to `SSL_CTX_set_alpn_select_cb'
Google查問題掉了一把頭發(fā)臼婆，最后發(fā)現(xiàn)是機(jī)器openssl版本問題，因?yàn)閚ginx中用到了openssl新版本的東西而當(dāng)前版本是沒有的幌绍，于是接下來就應(yīng)該去下載新版本的openssl了颁褂。
wget https://www.openssl.org/source/openssl-1.0.2r.tar.gz
tar -xzf openssl-1.0.2r.tar.gz
#重新編譯模塊
/home/nginx-1.14.2/configure --prefix=/usr/local/nginx
--with-http_ssl_module
--with-openssl=/home/openssl-1.0.2r
備份原來nginx文件
cp /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.bak
#將新編譯的nginx文件替換原有的
cp objs/nginx /usr/local/nginx/sbin/nginx
最后檢查nginx配置是否正確
/usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
#啟動(dòng)nginx
/usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx.conf
