Re: Whitelisting Client Side Certificates

2014-02-26 Thread David Birdsong
On Wed, Feb 26, 2014 at 9:58 AM, David Birdsong wrote: > Having just gone through learning about this over the last few days, > here's what I learned. Take it w/ a grain of salt. > > There are 2 ways I'm aware of. > > 1. turn on strict client verify and limit the ca list that the server > knows ab

Re: [SHOW'N'TELL] Primitive RBAC/AAA implementation in nginx config

2014-02-26 Thread Jonathan Matthews
On 26 Feb 2014 12:05, "Jonathan Matthews" wrote: > > Hi all - > > I spent some time poking at a interesting problem that came up last > night, and ended up with this primitive RBAC system, implemented in > declarative nginx config. Thanks to the couple of people who reminded me this may not be a

Re: SSL_STAPLING when network is unreachable

2014-02-26 Thread mastercan
Hello Maxim, > On startup, nginx does name resolution of various names in a > configuration files, using system resolver. This includes initial > resolution of OCSP responders if stapling is used. If your system > resolver doesn't have internet access and blocks trying to resolve > names - s

Re: Whitelisting Client Side Certificates

2014-02-26 Thread David Birdsong
On Wed, Feb 26, 2014 at 9:58 AM, David Birdsong wrote: > Having just gone through learning about this over the last few days, > here's what I learned. Take it w/ a grain of salt. > > There are 2 ways I'm aware of. > > 1. turn on strict client verify and limit the ca list that the server > knows ab

Re: Whitelisting Client Side Certificates

2014-02-26 Thread David Birdsong
Having just gone through learning about this over the last few days, here's what I learned. Take it w/ a grain of salt. There are 2 ways I'm aware of. 1. turn on strict client verify and limit the ca list that the server knows about. this will cause the server to have a limited view of what certs

Whitelisting Client Side Certificates

2014-02-26 Thread paddy3883
I'm currently working on POC for my company which is looking to use NGINX to validate API Requests using Client Side Certificates. Presently we have it setup so we are self signing/generating these certificates on the local machine and are able to use these successfully in our tests. We are also ab

Re: SSL_STAPLING when network is unreachable

2014-02-26 Thread Maxim Dounin
Hello! On Wed, Feb 26, 2014 at 11:39:31AM -0500, mastercan wrote: > Hello, > > I've encountered a problem with nginx 1.5.10. > I'm running nginx on a highly available system (2 cluster node). > > When node1 fails, node2 is automatically coming into play. A few days ago > the internet connection

SSL_STAPLING when network is unreachable

2014-02-26 Thread mastercan
Hello, I've encountered a problem with nginx 1.5.10. I'm running nginx on a highly available system (2 cluster node). When node1 fails, node2 is automatically coming into play. A few days ago the internet connection was bad - on both nodes. They could ping the gateway only sporadically. Node2 bec

[SHOW'N'TELL] Primitive RBAC/AAA implementation in nginx config

2014-02-26 Thread Jonathan Matthews
Hi all - I spent some time poking at a interesting problem that came up last night, and ended up with this primitive RBAC system, implemented in declarative nginx config. You might find it useful, or might be able to tell me why it sucks hence how it could be improved ;-) Readme and config: http

Increase either types_hash_max_size: 1024 or types_hash_bucket_size: 32

2014-02-26 Thread Makailol Charls
Hello, I got below error after updating Nginx from nginx-1.4.4-1 to nginx-1.5.10-1. nginx: [emerg] could not build the types_hash, you should increase either types_hash_max_size: 1024 or types_hash_bucket_size: 32 nginx: configuration file /etc/nginx/nginx.conf test failed Could anyone explain w

Best possible configuration for file upload

2014-02-26 Thread snarapureddy
We are using nginx for file uploads instead of directing to the backend servrs. Used lua openresty module to get the data in chunks in write it to local disk. File size could vary from few KB's to 10MB. We are tuning worker process, connections, accept_mutex off etc, but if we cuncerrently upload

Re: RE: Odd issue with proxy_pass serving wrong cached data

2014-02-26 Thread itpp2012
disable gzip, sendfile off, use something else then epoll, disable proxy_cache_path and take it from there to see if it still happens. Posted at Nginx Forum: http://forum.nginx.org/read.php?2,247939,247950#msg-247950 ___ nginx mailing list nginx@nginx.

Re: Odd issue with proxy_pass serving wrong cached data

2014-02-26 Thread Maxim Dounin
Hello! On Wed, Feb 26, 2014 at 02:32:25AM +, Brian Hill wrote: > So now it doesn't look like it's a caching issue at all. I've > completely gutted my config files and stripped it down, and I'm > still seeing the same issue. I even shot a video of what I'm > seeing and stuck it on YouTube a

Re: gzip cause white screen of death (wsod)

2014-02-26 Thread leontinus
SOLVED, I add Transfer-Encoding:chunked; CASE CLOSED. Posted at Nginx Forum: http://forum.nginx.org/read.php?2,247944,247946#msg-247946 ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx