But compiling your own nginx is not trivial and I would not recommend it for everyone.
It would be great if there would be a great precompiled nginx with newest security fixes for my Ubuntu which can enable ngxpagespeed or the new brotli compression: This is missing in the open source world.
compiling your own nginx is not trivial and I would
not recommend it for everyone
Nginx's developers have been hinting that they're going to add support for loading .so modules, and I really hope they do!
This was probably a Good Idea (tm) for performance reasons - filtration is just a compile-time linked list of function calls. But it's barely documented at all!
http://mailman.nginx.org/pipermail/nginx-announce/2016/00017...
Interesting, lots of places I've worked that would have been a no go (security risk).
It reminds me of blocking ping to improve security or worse blocking all ICMP.
Compiler, and especially make are harmless by themselves. They aren't setuid all it's used for is translate file from one format (source code) to another (machine code). One might as well block sed, because it could be used to modify /etc/passwd or /etc/shadow.
A someone who would want to compromise hosts if they need binaries, they would precompile them statically, that way is a single file, no need for libraries and no need extra development packages with header files and more likely to work across wide range of systems.
[1] because, there were chef recipes that were compiling things :> Also, it decreases security, because now you need to run compiler as root, so you could be compromised through things like this: http://securitytracker.com/id/1004374
For your what its worth I agree with you, if you are at the point where an attacker is executive a compiler you are already hosed.
Another issue is that it presents a privilege escalation concern. If you compile stuff in a user account on the production machines that will be run with root privileges, if someone compromises that user account they can now put in place a compiler wrapper to embed their own code. Even if you don't do anything else in that account (e.g. sudo) that'd let them e.g. capture passwords the compilation presents another risk. (As an extension to this: Your dev and build environments are security critical; but in your production environment is often far more vulnerable - not least because it's far more visible)
I don't think these are very high on the list of things you should worry about as your system needs to be very locked down before an attacker that is able to make use of them won't have other just as good opportunities, but the more stuff you run in your production environment, the more opportunities you give an attacker.
I'd just send the binaries base64 encoded. Decoding is trivial, with any number of tools commonly installed in the system.
Limiting access to compilers, alone, is 100% useless. You either go a lot farther down that road, or there is no point in starting.
Hence the last paragraph of my comment above, which makes exactly that point.
Eg. Windows boxes rarely have a compiler and get hacked all the time.
https://developers.google.com/speed/pagespeed/module/build_n...
Alternatively a Docker ubuntu base image with nginx + pagespeed would be wonderful.
[Edit] Found these links:
https://github.com/laurisvan/docker-pagespeed/blob/master/Do... https://github.com/lewg/docker-nginx-pagespeed https://github.com/namshi/docker-node-nginx-pagespeed
It's still pretty easy. For those that have never done it, it's a configure-like script, make, make install. That's it. It's almost your standard autoconf package routine of ./configure && make && make install, except the configure script is oddly in a subdir and not from autofoo. But it is all covered in the documentation, IIRC.
The only real thing that is different is the binary itself, and the installation location. (But I did the latter on purpose, because I didn't want to collide with apt/dpkg's management of /usr/bin.)