Lion Cipher Lab
Stand up and harden an nginx web server
- AppSec / DevSecOps
- Beginner
- ~60 min
- Free · no account required
Why it matters
Reading a site's defences is one skill; building them is the other half, and it is where the levers actually live. When you run your own web server, every protection is a config line you own: whether traffic is encrypted, which TLS ciphers are allowed, which security headers the browser receives, whether your software version is broadcast to every visitor, and how large a request you will accept before rejecting it. A default install answers all of those in the most permissive, least-safe way. This lab walks the same server from a bare default to a hardened baseline, so that the headers you…
What you'll learn
- installing and running nginx
- serving a static page
- enabling TLS with Let's Encrypt or a self-signed cert
- applying a Mozilla-generated strong cipher config
- setting HSTS, CSP and X-Content-Type-Options on the server side
- hiding version tokens with server_tokens off
- disabling unused modules and capping request body size
- reloading nginx safely after a config test
Steps in this lab
- What you're building, and the rule of the lab
- Install nginx and serve a page
- Turn on TLS: Let's Encrypt for a real domain, self-signed for the lab
- Get a strong cipher configuration from Mozilla — don't invent one
- Set the security headers — this is the build side of the reading lab
- Stop advertising your version: server_tokens off
- Trim the attack surface: unused modules and request-size limits
- Test, reload, and what you've actually built