nginx：如何记录TLS错误(如果不支持的密码/协议)

我正在切换到100％https.
服务器正在运行nginx libressl.

在开始之前https：100％我有兴趣看到哪些客户端无法再连接到我的网站.
例如.因为我不支持SSL3.

我检查了nginx错误和访问日志,但如果我尝试连接SSL3,则没有包含有价值的信息.

我希望看到的内容：例如：

Client [IP]: Connection failed due to protocol/cipher mismatch.

然后,我将能够访问该访问/错误日志,并查看有多少客户端无法再访问我的站点.

这可能吗？

目前的nginx.conf：

user                        www-data www-data;

pid                         /run/nginx.pid;

worker_processes            auto;
worker_rlimit_nofile        100000;

error_log                   /var/log/nginx/error.log;

events {
    worker_connections      2048;
    use                     epoll;
    multi_accept            on;
}

http {
    server_tokens           off;
    autoindex               off;
    charset                 UTF-8;

    include                 mime.types;
    default_type            application/octet-stream;

    log_format              main '$host - $remote_addr - $remote_user [$time_local] "$request" '
                                 '$status $body_bytes_sent "$http_referer" '
                                 '"$http_user_agent" "$http_x_forwarded_for"';
    access_log              /var/log/nginx/access.log main;

    keepalive_timeout       10;

    reset_timedout_connection   on;
    client_body_timeout         10;
    send_timeout                10;

    client_max_body_size    512k;

    sendfile                on;
    tcp_nopush              on;
    tcp_nodelay             on;

    server {
        listen              80;
        server_name         domain.com www.domain.com;
        return              301 https://www.domain.com$request_uri;
    }

    server {
        listen              443 ssl spdy;
        server_name         domain.com;

        include             conf.d/ssl.conf;

        return              301 https://www.domain.com$request_uri;
    }

    server {
        listen              443 ssl spdy;
        server_name         www.domain.com;
        root                /var/www/vhosts/domain.com/public_html;

        include             conf.d/ssl.conf;

        default_type        text/html;

        location / {
            return 200 'Hello World!';
        }
    }
}

conf.d / ssl.conf中：

ssl                         on;

ssl_dhparam                 ssl/dhparam4096.pem;

ssl_session_cache           shared:SSL:10m;
ssl_session_timeout         10m;
ssl_buffer_size             1400;
spdy_headers_comp           6;
add_header                  Alternate-Protocol 443:npn-spdy/3;

ssl_protocols               TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers                 "AES256+EECDH:AES256+EDH";
ssl_prefer_server_ciphers   on;
ssl_ecdh_curve              secp384r1;

add_header                  X-Frame-Options DENY;
add_header                  X-Content-Type-Options nosniff;
add_header                  Strict-Transport-Security "max-age=31536000; includeSubDomains";

ssl_certificate             ssl/public.crt;
ssl_certificate_key         ssl/private.key;

ssl_stapling                on;
ssl_stapling_verify         on;
ssl_trusted_certificate     ssl/ca-certs.pem;
resolver                    8.8.8.8 valid=300s;
resolver_timeout            10s;

以我的情况为例,我在/etc/nginx/nginx.conf中有以下几行 –

...
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$ssl_protocol '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;
...

如果我使用curl建立SSLv3连接 –

daniel@localhost$curl -k --sslv3 https://todo.home.net/login.php
curl: (35) error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure

我在/var/log/nginx/access.log中看到以下几行 –

192.168.10.206 - - [26/Apr/2015:18:21:25 -0700] "GET HTTP/1.0" SSLv3 400 173 "-" "-" "-"
192.168.10.206 - - [26/Apr/2015:18:21:43 -0700] "GET HTTP/1.0 /login.php" SSLv3  400 173 "-" "-" "-"
192.168.10.206 - - [26/Apr/2015:18:22:56 -0700] "-" SSLv3  400 0 "-" "-" "-"
192.168.10.206 - - [26/Apr/2015:18:23:04 -0700] "-" SSLv3  400 0 "-" "-" "-"

如果在Nginx服务器上禁用SSLv3,则客户端会出现错误 –

在服务器端,日志文件将包含协议版本和HTTP代码400,您可以使用该信息来识别使用SSLv3的客户端.

（编辑：岳阳站长网）

【声明】本站内容均来自网络，其相关言论仅代表作者个人观点，不代表本站立场。若无意侵犯到您的权利，请及时与联系站长删除相关内容!