NGINX 1.4.6 upgrade on AWS EC2

I've been working with NGINX a lot more lately and still love it.

The info:
Using AWS EC2 with Ubuntu 14.04 (trusty)
NGINX 1.4.6 as a web server

During a PCI compliance scan, it was found the the server I was working on was running NGINX 1.4.6, a version released on 2014-03-04, nearly 2 and a half years old (at this writing).

This is the default version installed with the AWS packages for Ubuntu anyway, but I'm not sure about other packages.

On the DEV machine I was using, I tried to do the basic update:
sudo apt-get install nginx

The resulting version of NGINX was still 1.4.6, so I figured it was the repo being used.


FIRST STEP: Make sure you backup your config files!!! To some place other than /etc/nginx/, like perhaps your home dir. When I performed my install, all the files in /etc/nginx/sites-available were deleted.

I found this nice article on nginx's website: https://www.nginx.com/resources/admin-guide/installing-nginx-open-source/#prebuilt_ubuntu
I followed the above section on Ubuntu and everything went great.


After the upgrade was complete, I was running 1.11.4. Great! But now I had to configure my website.
The files in /etc/nginx/sites-available  were gone, so I copied my backup to that directory.

Then in /etc/nginx/nginx.conf

1. set user to www-data
2. Add the line if you are still using sites-available:
1. include /etc/nginx/sites-enabled/*;

In the directory /etc/nginx/conf.d, rename default.conf to something else.

Restart NGINX:
sudo service nginx restart

IP Range for where you are.

Synopsis....

I needed to enable a range of IP's for use in an AWS Security Group so that other developers could access a test website I was working on. Here's how I found the smallest range, rather than opening it the whole world. NOTE: There is a small security issue with this method, it is described below.

All IP's pointing to me have been obfuscated...your eyes aren't going bad. :)

Step 1 - Find your IP

There's lots of ways to do this, but the quick simple way I use is simply going to

https://myip.ms/

And there's your IP!

Step 2 - Find Your IP Range

Now you know your IP. Now click on the WHOIS? icon and it takes you to the next page which shows you everything known about that IP. Who owns it, the IP range that is owned by them, etc.

Here's my general IP range:
X.X.128.0 - X.X.255.255    (32,768 ip)

So I want to figure out the short form of that IP Range.

Scroll down (or search) for CIDR. This is the value you want to use. The whole thing. For example, X.X.128.0/17 (it may be different based on the IP Range from above).



This CIDR is the value I used in the AWS console to denote my range of IP's.

Now the security hole here is that anyone in this set of 32,768 IP's can access my special website (on a specific port) that I setup with this particular rule. I'm ok with this small, if not virtually non-existent hole for my TEST website. Risk vs. Reward. I'll be sure to lock down the production site though.

More information on CIDR and what it means:
https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing