Nessus Scans show HSTS not enabled on the port serving Nexus 3.16.1-02

Kenny D'Airo

unread,

Jun 11, 2019, 9:03:46 AM6/11/19

to Nexus Users

HSTS is not showing up as enabled in Nessus Scans on the port serving Nexus 3.16.1-02

Hello,

I'm trying to get HSTS enabled on Nexus OSS 3.16.1-02

From what I've read, this is enabled by default in the jetty-https.xml file for the application with the following piece of code...specifically the SecureRequestCustomizer

<Ref refid="httpConfig">
<Set name="secureScheme">https</Set>
<Set name="securePort"><Property name="application-port-ssl" default="443"/></Set>
</Ref>

I've created an edited jetty-ssl.xml and added it to the /etc/jetty/ directory and the nexus.properties args for which xml files to call.

After restarting the application and looking at the logs, everything looks good. The application is available, but Nessus scans for the HSTS vulnerability are still coming back positive.

The default https://localhost:443/nexus is currently configured behind an F5 reverse-proxy and HSTS is enabled on the F5, ssl is enabled in the application as well, terminating on port 443.

nexus.properties is calling for the jetty.xml,jetty-https.xml,jetty-ssl.xml,jetty-requestlog.xml when the application starts.

If the contents of any of the jetty files would help or the log files I can make those available as well.

Any additional information on why this might coming up still would be greatly appreciated.

Thank you

Kenny D'Airo

unread,

Jun 17, 2019, 10:18:42 AM6/17/19

to Nexus Users

I was able to resolve this issue. Here are the contents of the jetty-rewrite.xml in case anyone else is having problems with this and a brief outline of what the application is calling for now.

So after enabling HTTPS for the application, the STRICT-TRANSPORT-SECURITY was still not showing in the headers of the URL

I had to create a jetty-rewrite.xml and add that to the list of xml files that the application was calling for. So at this point the application is calling for ONLY the jetty.xml, jetty-https.xml, jetty-rewrite.xml, and jetty-requestlog.xml

Here are the contents of the jetty-rewrite.xml

<?xml version="1.0"?>
<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure.dtd">

<Configure id="Server" class="org.eclipse.jetty.server.Server">

<Get id="oldhandler" name="handler"/>

<Set name="handler">
     <New id="Rewrite" class="org.eclipse.jetty.rewrite.handler.RewriteHandler">
      <Set name="handler"><Ref id="oldhandler"/></Set>
      <Set name="rewriteRequestURI">true</Set>
      <Set name="rewritePathInfo">true</Set>
      <Set name="originalPathAttribute">requestedPath</Set>

<Call name="addRule">
        <Arg>
          <New class="org.eclipse.jetty.rewrite.handler.HeaderPatternRule">
             <Set name="pattern">/*</Set>
            <Set name="name">Strict-Transport-Security</Set>
            <Set name="value">max-age=31536000; includeSubDomains</Set>
          </New>
        </Arg>
      </Call>
     </New>
    </Set>

</Configure>

Now when I run a cURL -I on the URL that Nexus is exposed on I am getting the following headers and Nessus scans are showing NO vulnerabilities.

C:\>curl -i https://localhost:443/nexus

HTTP/1.1 302 Found
Date: Mon, 17 Jun 2019 14:03:20 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://localhost/nexus/
Content-Length: 0
Server: Jetty(9.4.14.v20181114)

Peter Lynch

unread,

Jun 18, 2019, 4:31:44 PM6/18/19

to Kenny D'Airo, Nexus Users

It's perhaps a lot simpler than what you've done. All that is needed is one or 2 lines additional to the jetty-https.xml config:

https://issues.sonatype.org/browse/NEXUS-20268

Example:

<New id="httpsConfig" class="org.eclipse.jetty.server.HttpConfiguration">
    <Arg><Ref refid="httpConfig"/></Arg>
    <Call name="addCustomizer">
      <Arg><New class="org.eclipse.jetty.server.SecureRequestCustomizer">

        <!-- 7776000 seconds = 90 days --> 
        <Set name="stsMaxAge">7776000</Set>

        <Set name="stsIncludeSubDomains">true</Set>
      </New>
      </Arg>
    </Call>
  </New>

--
You received this message because you are subscribed to the Google Groups "Nexus Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to nexus-users...@glists.sonatype.com.
To view this discussion on the web visit https://groups.google.com/a/glists.sonatype.com/d/msgid/nexus-users/ef6c4e8d-86b5-4343-b2cd-08ad46754404%40glists.sonatype.com.

--

Peter Lynch
Senior Product Support Engineer

Reply all

Reply to author

Forward