Research on Nginx security configuration (1)

0x00 test environment

Operating System: CentOS6.5 Web server: Nginx1.4.6 Php version: Php5.4.26

0x01 Nginx Introduction

Nginx itself cannot process PHP. It is only a web server. After receiving the request, if it is a php request, it is sent to the php interpreter for processing and the result is returned to the client. Nginx generally sends a request to the fastcgi management process for processing. The fastcgi management process selects the cgi sub-process for processing the result and returns nginx.

Nginx involves two accounts: one is the nginx Running Account and the other is the php-fpm running account. If you access a static file, you only need the nginx running account to have the permission to read the file. If you access a PHP file, first, the nginx Running Account needs to have the permission to read the file. After reading the file, it finds that it is a php file and forwards it to php-fpm, in this case, the php-fpm account must have the permission to read the file.

0x02 conclusions

1. in linux, to read a file, you must first have the execution permission on the folder where the file is located, and then read the file.
2. The execution of php files does not require the execution permission of the files. You only need the read permission of the nginx and php-fpm running accounts.
3. Whether a folder can be listed after a trojan is uploaded depends on the folder read permission of the php-fpm running account.
4. the permission to run commands on trojans depends on the account permission of php-fpm.
5. If the Trojan horse needs to execute the command, the php-fpm account must have the permission to execute the corresponding sh.
6. to read files in a folder, you do not need to have the read permission on the folder. You only need to have the execution permission on the folder.

0x03 security configurations involved in the Nginx Server

1. Nginx. conf configuration
2. configuration of php-fpm.conf
3. Configure disk permissions for the running accounts of nginx and php-fpm
4. Php. ini configuration