Notes on nginx Security Configuration Under CentOS

Notes on nginx Security Configuration Under CentOS

Web server: nginx/1.6.2
PHP version: Php5.4.26

0x01 Nginx Introduction

Nginx itself cannot process PHP. It is only a web server. After receiving the request, if it is a php request, it is sent to the php interpreter for processing and the result is returned to the client. Nginx generally sends a request to the fastcgi management process for processing. The fastcgi management process selects the cgi sub-process for processing the result and returns nginx.
Nginx involves two accounts: one is the nginx Running Account and the other is the php-fpm running account. If you access a static file, you only need the nginx running account to have the permission to read the file. If you access a PHP file, first, the nginx Running Account needs to have the permission to read the file. After reading the file, it finds that it is a php file and forwards it to php-fpm, in this case, the php-fpm account must have the permission to read the file.

0x02 conclusions

1. in linux, to read a file, you must first have the execution permission on the folder where the file is located, and then read the file.
2. The execution of php files does not require the execution permission of the files. You only need the read permission of the nginx and php-fpm running accounts.
3. Whether a folder can be listed after a trojan is uploaded depends on the folder read permission of the php-fpm running account.
4. the permission to run commands on trojans depends on the account permission of php-fpm.
5. If the Trojan horse needs to execute the command, the php-fpm account must have the permission to execute the corresponding sh.
6. to read files in a folder, you do not need to have the read permission on the folder. You only need to have the execution permission on the folder.

0x03 security configurations involved in the Nginx Server

1. Nginx. conf configuration
2. configuration of php-fpm.conf
3. Configure disk permissions for the running accounts of nginx and php-fpm
4. Php. ini configuration
0x04 common operations to be configured
1. Prohibit Access to a directory
Example: Prohibit Access to the path directory
Location ^ ~ /Path {
Deny all;
}
You can replace the path with the actual desired directory. Whether the directory path contains "/" or not will prohibit access to the Directory and all files in the directory. The absence of "/" is complicated. It is forbidden as long as the keyword matches at the beginning of the directory. Note that it should be placed before fastcgi configuration.

2. Prohibit PHP file access and execution
Example: remove the PHP Execution permission for a single directory
Location ~ /Attachments/. * \. (php | php5 )? $ {
Deny all;
}
Location ~
/(Attachments | upload)/. * \. (php | php5 )? $ {
Deny all;
}
Example: remove the PHP Execution permission for multiple directories

3. Prohibit Access from IP addresses
Example: writing an IP segment prohibited:
Deny 10.0.0.0/24;
Allow
X. x;
Allow 10.0.0.0/24;
Deny all;
Example: only access from an IP address or an IP segment is allowed. All other users are prohibited.

0x05 Common Problems to be Solved

1. After the trojan is uploaded, the upload directory cannot be executed. Add the configuration in the nginx configuration file so that php cannot be parsed.
2. Disable the permission of the php-fpm running account to read other directories after the Trojan Horse is executed.
3. commands executed by Trojans cannot be executed to cancel the sh execution permission of the php-fpm account.
4. After the command is executed, the permission cannot be too high. Do not use the root account or join the root group for the Php-fpm account.

0x06 Nginx security configuration Scheme

1. Modify the website directory owner to be a non-php-fpm running account. Here, change the owner to root.
Chown-R root: root html/

2. Change the Running Account and group of nginx and php-fpm to nobody.
Nginx. conf
Php-fpm.conf

3. Cancel the read permission of nobody to all directories, and then add the read permission to the website directory.
Chmod o-r-R/
Chmod o + r-R html/

4. Cancel the execution permission of nobody for/bin/sh.
Chmod 776/bin/sh

5. Check that the permissions of the website directory to nobody are readable and executable, And the permissions to website files are readable.
6. Add the nobody write permission to the upload directory or the directory where the Write File is written.
7. Configure nginx. conf without php Execution permission for the upload directory
8. configure a folder that is not accessible by nginx. conf, such as the background, or restrict access to ip addresses.
9. Configure the types of files that are not accessible by nginx. conf, such as some txt log files.
Common commands:
Ll-d html/
Chown-R root: root html/
Ll-d html/
Root @ kali :~ # Leafpad/etc/nginx. conf
User nobody;
######################################## #####
User = nobody;

Group = nobody;