Research on Nginx Security Configuration

0x00 test environment

Operating System: CentOS6.5 Web server: Nginx1.4.6 Php version: Php5.4.26

0x01 Nginx Introduction

Nginx itself cannot process PHP. It is only a web server. After receiving the request, if it is a php request, it is sent to the php interpreter for processing and the result is returned to the client. Nginx generally sends a request to the fastcgi management process for processing. The fastcgi management process selects the cgi sub-process for processing the result and returns nginx.

Nginx involves two accounts: one is the nginx Running Account and the other is the php-fpm running account. If you access a static file, you only need the nginx running account to have the permission to read the file. If you access a PHP file, first, the nginx Running Account needs to have the permission to read the file. After reading the file, it finds that it is a php file and forwards it to php-fpm, in this case, the php-fpm account must have the permission to read the file.

0x02 conclusions

1. in linux, to read a file, you must first have the execution permission on the folder where the file is located, and then read the file. 2. The execution of php files does not require the execution permission of the files. You only need the read permission of the nginx and php-fpm running accounts. 3. Whether a folder can be listed after a trojan is uploaded depends on the folder read permission of the php-fpm running account. 4. the permission to run commands on trojans depends on the account permission of php-fpm. 5. If the Trojan horse needs to execute the command, the php-fpm account must have the permission to execute the corresponding sh. 6. to read files in a folder, you do not need to have the read permission on the folder. You only need to have the execution permission on the folder.

0x03 security configurations involved in the Nginx Server

1. Nginx. conf configuration 2. php-fpm.conf configuration 3. nginx and php-fpm run account permissions on disk configuration 4. Php. ini configuration

 

0x04 common operations to be configured

1. Prohibit Access to a directory

Example: Prohibit Access to the path directory

location ^~ /path {deny all;}

You can replace the path with the actual desired directory. Does the directory path contain "/", with "/" only prohibit access to directories, without "/" prohibit access to files in directories; before configuring fastcgi.

2. Prohibit PHP file access and execution

Example: remove the PHP Execution permission for a single directory

location ~ /attachments/.*\.(php|php5)?$ {deny all;}

Example: remove the PHP Execution permission for multiple directories

location ~/(attachments|upload)/.*\.(php|php5)?$ {deny all;}

3. Prohibit Access from IP addresses

Example: writing an IP segment prohibited:

deny 10.0.0.0/24;

Example: only access from an IP address or an IP segment is allowed. All other users are prohibited.

allow  x.x.x.x;  allow 10.0.0.0/24;  deny all;

0x05 Common Problems to be Solved

1. Make the trojan file unexecutable

Add the configuration to the nginx configuration file for the upload directory so that php cannot be parsed.

2. Disable non-website directory files after Trojan execution

Cancel the permission of the php-fpm running account to read other directories.

3. After the trojan is executed, the command cannot be executed.

Cancel the sh execution permission of the php-fpm account.

4. The command execution permission cannot be too high

Do not use root for a Php-fpm account or join the root group.

 

0x06 Nginx security configuration Scheme

1. Modify the website directory owner to be a non-php-fpm running account. Here, change the owner to root.

Command:

chown -R root:root html/ 

2. Change the Running Account and group of nginx and php-fpm to nobody.

Nginx. conf

Php-fpm.conf

3. Cancel the read permission of nobody to all directories, and then add the read permission to the website directory.

Command:

chmod o-r –R / chmod o+r –R html/

4. Cancel the execution permission of nobody for/bin/sh.

chmod 776 /bin/sh

5. Check that the permissions of the website directory to nobody are readable and executable, And the permissions to website files are readable.

6. Add the nobody write permission to the upload directory or the directory where the Write File is written.

7. Configure nginx. conf without php Execution permission for the upload directory

8. configure a folder that is not accessible by nginx. conf, such as the background, or restrict access to ip addresses.

9. Configure the types of files that are not accessible by nginx. conf, such as some txt log files.