Enable HSTS on 3CX server

[javond01]

We recently did an internal pen-test and the results came back that our 3CX server running Debian does not have HSTS enforced as defined by RFC 6797. How do we enable it?

Thanks.

 

[SweetAction]

Supported way? Doesn't exist.
Unsupported? You can edit the nginx config

add_header Strict-Transport-Security "max-age=63072000" always;
https://ssl-config.mozilla.org/#ser...7.3&config=modern&openssl=3.4.0&guideline=5.7

 

[KyriacosS_3CX]

Do note that some older devices might need plain HTTP for provisioning, so check your environment more generally before blocking that function.

 

[javond01]

Supported way? Doesn't exist.
Unsupported? You can edit the nginx config

add_header Strict-Transport-Security "max-age=63072000" always;
https://ssl-config.mozilla.org/#ser...7.3&config=modern&openssl=3.4.0&guideline=5.7

Thank you for your quick response. Where is the nginx config located, and do you just add the text add_header Strict-Transport-Security "max-age=63072000" always into the file?

 

[javond01]

Do note that some older devices might need plain HTTP for provisioning, so check your environment more generally before blocking that function.

Thank you for mentioning that. It looks like all our phones except the W60B use https for provisioning. However, we don't even allow the http port through the firewall that the W60B uses for provisioning, so I will have to look into that to see if I can change it to use https or else open up the http port or those devices might not provision.

 

[SweetAction]

Thank you for your quick response. Where is the nginx config located, and do you just add the text add_header Strict-Transport-Security "max-age=63072000" always into the file?

I don't think 3CX would appreciate me providing step by step instructions on their forum for something they don't want done. But I'm sure if you google "nginx locate config file" and nginx add header" you will find many guides on how to do it.

3CX installs into /var/lib/3cxpbx on linux. All 3CX pieces, including nginx configs, are located there.

 

[javond01]

I don't think 3CX would appreciate me providing step by step instructions on their forum for something they don't want done. But I'm sure if you google "nginx locate config file" and nginx add header" you will find many guides on how to do it.

3CX installs into /var/lib/3cxpbx on linux. All 3CX pieces, including nginx configs, are located there.

Perfectly understandable. Thank you.