MetaDefender ICAP Server integrates with NGINX via the upstream module (reverse proxy) and related configuration directives.

The integration is enabled via a certified NGINX Dynamic Module.

on RHEL or CentOS, httpd_can_network_connect must be enabled by command:

setsebool -P httpd_can_network_connect 1

More details about httpd_can_network_connect, please refer to https://www.nginx.com/blog/using-nginx-plus-with-selinux/#Issue-1:-Proxy-Connection-is-Forbidden

Sets the protocol, address and optional URI of the proxied MD ICAP server. “http” or “https” protocols can be specified. The address can be specified as a domain name or IP address, and an optional port:

ometascan_pass http://icap_server:8080;

If an error occurs when sending a sub-request to the MD ICAP Server (timeout, network issue, etc) an error will be sent back to the ICAP client, and the request will be blocked.

When using ometascan_pass, the proxy_request_buffering of the Nginx proxy module will be disabled.

When the sub-request to MD ICAP Server error (Timeout, Network, etc). The error will respond to the client, and the request blocked.

When allowed with sanitized the filename parameter of Content-Disposition header will be renamed corresponding Metadender Core's CDR setting

This directive specifies HTTP request methods that are considered by ometascan_pass. HTTP request methods not listed will be ignored. The following HTTP methods are allowed: GET, HEAD, POST, PUT, PATCH, and DELETE

Sets a timeout for transmitting a request to the proxied server. The timeout is set only between two successive write operations, not for the transmission of the whole request. If the proxied server does not receive anything within this time, the connection is closed.

Time intervals can be specified in milliseconds, seconds, minutes, hours, days and so on. Refer here for more information.

Time intervals can be specified in milliseconds, seconds, minutes, hours, days and so on, using the following suffixes:

ms milliseconds

s seconds

m minutes

h hours

d days

w weeks

M months, 30 days

y years, 365 days

Ref: Configuration file measurement units (nginx.org)

Defines a timeout for establishing a connection with a proxied server. Note that this timeout should not exceed 75 seconds.

Defines a timeout for reading a response from the proxied server. The timeout is set only between two successive read operations, not for the transmission of the whole response. If the proxied server does not transmit anything within this time, the connection is closed.

Supported since version 1.1.0

• This will allow bad request traffic go to the protected system

• Only enable this directive for testing purpose

• Supported since Ometascan NGINX module v1.2.0

• Must use MD ICAP Server v5.4.0 or newer

• The ometascan_allow_bad_request_traffic on required the ometascan_pre_cache on

This configuration will not work when AppProtect is used and put on same scope

Turn on/off pre-caching request when sending to MD ICAP Server.

When the cache is enabled the module will make a copy of the request on the NGINX server. And send it to the back-end when received allowed message from MD ICAP Server

ometascan_pre_cache_size is deprecated since Ometascan NGINX module v1.2.0

Config maximum caching size per request. Sizes can be specified in bytes, kilobytes (suffixes k and K) or megabytes (suffixes m and M), for example, “1024”, “8k”, “1m”.

Specifies a file with trusted CA certificates in the PEM format used to verify the certificate of the proxied HTTPS server.

Enables or disables verification of the proxied HTTPS server certificate.

Sets the verification depth in the proxied HTTPS server certificates chain.

Enables the specified protocols for requests to a proxied HTTPS server.

Specifies the enabled ciphers for requests to a proxied HTTPS server. The ciphers are specified in the format understood by the OpenSSL library.

The full list can be viewed using the “openssl ciphers” command.

Determines whether SSL sessions can be reused when working with the proxied server. If the errors “SSL3_GET_FINISHED:digest check failed” appear in the logs, try disabling session reuse.

Required:

• The header contains a key Connection with the value keepalive.

• Enabled persistence connection of the MD ICAP Server (Global settings)

E.g: proxy_set_header Connection 'keepalive';

Allows overriding the server name used to verify the certificate of the proxied HTTPS server and to be passed through SNI when establishing a connection with the proxied HTTPS server.

By default, the host part of the ometascan_pass URL is used.

Enables or disables passing of the server name through TLS Server Name Indication extension (SNI, RFC 6066) when establishing a connection with the proxied HTTPS server.

• client_max_body_size Sets the maximum allowed size of the client request body. If the size in a request exceeds the configured value, the 413 (Request Entity Too Large) error is returned to the client. Please be aware that browsers cannot correctly display this error. Setting size to 0 disables checking of client request body size.

• ometascan_pass Set URL of the MD ICAP Server

• ometascan_methods POST PUT; Only scan POST and PUT methods

• client_max_body_size Sets the maximum allowed size of the client request body. If the size in a request exceeds the configured value, a 413 error (Request Entity Too Large) is returned to the client. Please be aware that browsers cannot correctly display this error. Setting size to 0 disables checking of client request body size.

• ometascan_pass Set URL of the MD ICAP Server

• ometascan_methods POST PUT; (only enables scans for POST and PUT methods)

Add ssl, ssl_certificate and ssl_certificate_key variables. Refer here for more information regarding nginx HTTPS configuration.

Performance test results are performed in a controlled environment and serve only as a reference. The results demonstrate the raw throughput capacity for the MD ICAP Server, outside of any scanning activity performed by MetaDefender Core. Overall solution performance will depend on several factors including available system resources, file content (dataset) and network performance.