Nginx anti-theft chain and access control, Nginx parsing PHP configuration and proxy

Nginx Anti-theft chain

1. Edit the configuration file:

location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)${    expires 7d;    valid_referers none blocked server_names  *.test.com ;    if ($invalid_referer) {        return 403;    }    access_log off;}

2. Test Reload:

[[email protected] ~]# /usr/local/nginx/sbin/nginx  -tnginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is oknginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful[[email protected] ~]# /usr/local/nginx/sbin/nginx -s reload

3. Verify that:

[[email protected] ~]# curl -e "http://www.baidu.com/1.txt" -x127.0.0.1 -I test.com/1.gifcurl: (7) Failed connect to 127.0.0.1:1080; 拒绝连接[[email protected] ~]# curl -e "http://www.baidu.com/1.txt" -x127.0.0.1:80 -I test.com/1.gifHTTP/1.1 403 ForbiddenServer: nginx/1.12.2Date: Thu, 15 Mar 2018 14:25:23 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-alive[[email protected] ~]# curl -e "http://www.test.com/1.txt" -x127.0.0.1:80 -I test.com/1.gifHTTP/1.1 200 OKServer: nginx/1.12.2Date: Thu, 15 Mar 2018 14:25:35 GMTContent-Type: image/gifContent-Length: 14Last-Modified: Wed, 14 Mar 2018 17:20:46 GMTConnection: keep-aliveETag: "5aa959ee-e"Expires: Thu, 22 Mar 2018 14:25:35 GMTCache-Control: max-age=604800Accept-Ranges: bytes

Nginx access Control

For catalog
1. Edit the configuration file:

 location /admin/    {         allow 127.0.0.1;         allow 192.168.188.130;         deny all;    }

2. Test and Reload:

[[email protected] ~]# /usr/local/nginx/sbin/nginx  -tnginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is oknginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful[[email protected] ~]# /usr/local/nginx/sbin/nginx -s reload

3. Verify:

[[email protected] ~]# curl -e "http://www.baidu.com/1.txt" -x127.0.0.1:80 -I test.com/admin/HTTP/1.1 200 OKServer: nginx/1.12.2Date: Thu, 15 Mar 2018 14:52:12 GMTContent-Type: application/octet-streamContent-Length: 10Last-Modified: Thu, 15 Mar 2018 14:52:04 GMTConnection: keep-aliveETag: "5aaa8894-a"Accept-Ranges: bytes

For the regular:

4. Modify the configuration file:

location ~ .*(upload|image)/.*\.php${           deny all;}

5. Test and Reload:

[[email protected] ~]# /usr/local/nginx/sbin/nginx  -tnginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is oknginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful[[email protected] ~]# /usr/local/nginx/sbin/nginx -s reload

6. Verify that:

[[email protected] ~]# mkdir /data/wwwroot/test.com/upload[[email protected] ~]# echo "1111" > /data/wwwroot/test.com/upload/1.php[[email protected] ~]# curl -x127.0.0.1:80 test.com/upload/1.php

[[email protected] ~]# echo "1111" > /data/wwwroot/test.com/upload/1.txt[[email protected] ~]# curl -x127.0.0.1:80 test.com/upload/1.txt1111

7. For user_agent restrictions, modify the configuration file:

if ($http_user_agent ~ ‘Spider/3.0|YoudaoBot|Tomato‘){ return 403;} 

8. Test and Reload:

[[email protected] ~]# /usr/local/nginx/sbin/nginx -tnginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is oknginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful[[email protected] ~]# /usr/local/nginx/sbin/nginx -s reload

9. Verify:

[[email protected] ~]# curl -A Tomatosjklajg-x127.0.0.1:80 test.com/upload/1.txt -IHTTP/1.1 403 ForbiddenServer: nginx/1.12.2Date: Thu, 15 Mar 2018 15:05:33 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-alive[[email protected] ~]# curl -A Tmatosjklajg-x127.0.0.1:80 test.com/upload/1.txt -IHTTP/1.1 200 OKServer: nginx/1.12.2Date: Thu, 15 Mar 2018 15:05:47 GMTContent-Type: text/plainContent-Length: 5Last-Modified: Thu, 15 Mar 2018 15:01:29 GMTConnection: keep-aliveETag: "5aaa8ac9-5"Accept-Ranges: bytes

Nginx parsing PHP related configuration

1. Modify the configuration file:

[[email protected] ~]# vim /usr/local/nginx/conf/vhost/test.com.conf

location ~ \.php$    {        include fastcgi_params;        fastcgi_pass unix:/tmp/php-fcgi.sock;        fastcgi_index index.php;        fastcgi_param SCRIPT_FILENAME /data/wwwroot/test.com$fastcgi_script_name;    }

2. Test:

[[email protected] ~]# vi /data/wwwroot/test.com/3.php[[email protected] ~]# curl -x127.0.0.1:80 test.com/3.php<?phpphpinfo();

Unable to parse, reload

[[email protected] ~]# /usr/local/nginx/sbin/nginx  -tnginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is oknginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful[[email protected] ~]# /usr/local/nginx/sbin/nginx -s reload

View results again
Can parse normally
3. If you encounter 502 of the situation:

location ~ \.php$    {        include fastcgi_params;        fastcgi_pass unix:/tmp/php-fgi.sock;                      #此行配置要根据主配置文件来看是写sock还是ip地址，一定要保持一致        fastcgi_index index.php;        fastcgi_param SCRIPT_FILENAME /data/wwwroot/test.com$fastcgi_script_name;    }    access_log /tmp/test.com.log weixing;}

[[email protected] ~]# curl -x127.0.0.1:80 test.com/3.php

This happens when there is inconsistency.

Nginx Agent

1. Write a configuration file:

[[email protected] ~]# cd /usr/local/apache2.4/ bin/       include/   libexec/   nginx/     php-fpm/   src/       apr/       etc/       lib/       mariadb/   php/       sbin/      apr-util/  games/     lib64/     mysql/     php7/      share/     [[email protected] ~]# cd /usr/local/nginx/conf[[email protected] conf]# cd vhost/[[email protected] vhost]# vim proxy.conf

server{    listen 80;    server_name ask.apelearn.com;    location /    {        proxy_pass      http://47.91.145.78/;        proxy_set_header Host   $host;        proxy_set_header X-Real-IP      $remote_addr;        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;    }}

2. Verify and Reload:

[[email protected] vhost]# /usr/local/nginx/sbin/nginx  -tnginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is oknginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful[[email protected] vhost]# /usr/local/nginx/sbin/nginx -s reload

3. Perform the test:

[[email protected] vhost]# curl -x127.0.0.1:80  ask.apelearn.com/robots.txt## robots.txt for MiWen#User-agent: *Disallow: /?/admin/Disallow: /?/people/Disallow: /?/question/Disallow: /account/Disallow: /app/Disallow: /cache/Disallow: /install/Disallow: /models/Disallow: /crond/run/Disallow: /search/Disallow: /static/Disallow: /setting/Disallow: /system/Disallow: /tmp/Disallow: /themes/Disallow: /uploads/Disallow: /url-*Disallow: /views/

Nginx anti-theft chain and access control, Nginx parsing PHP configuration and proxy