Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

nginx: added some security related configs #3330

Closed
wants to merge 2 commits into from
Closed

nginx: added some security related configs #3330

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c769ce5
added some security related configs
Apr 25, 2021
47231f9
changed according to comments by rhukster
Apr 26, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 30 additions & 1 deletion webserver-configs/nginx.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,22 @@ server {
}
## End - Index

## Begin - ACME (LetsEncrypt)
# adapt the alias folder to where your certification job (e.g. CertBot)
# puts the domain verification challenges
# location ^~ /.well-known/acme-challenge/ {
# alias /srv/http/acme;
# }
## End - ACME (LetsEncrypt)

## Begin - Security
# safety stuff adopted from .htaccess
if ($request_uri ~ "{{|}}|{%|%}") { return 403; }
if ($query_string ~ "{{|}}|{%25|%25}") { return 403; }
if ($query_string ~ "base64_encode[^(]*\([^)]*\)") { return 403; }
if ($query_string ~* "(<|%3C)([^s]*s)+cript.*(>|%3E)") { return 403; }
if ($query_string ~ "GLOBALS(=|\[|\%[0-9A-Z]{0,2})") { return 403; }
if ($query_string ~ "_REQUEST(=|\[|\%[0-9A-Z]{0,2})") { return 403; }
# deny all direct access for these folders
location ~* /(\.git|cache|bin|logs|backup|tests)/.*$ { return 403; }
# deny running scripts inside core system folders
Expand All @@ -25,6 +40,8 @@ server {
location ~* /user/.*\.(txt|md|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ { return 403; }
# deny access to specific files in the root folder
location ~ /(LICENSE\.txt|composer\.lock|composer\.json|nginx\.conf|web\.config|htaccess\.txt|\.htaccess) { return 403; }
# deny all files and folder beginning with a dot (hidden files & folders)
location ~ (^|/)\. { return 403; }
## End - Security

## Begin - PHP
Expand All @@ -39,6 +56,18 @@ server {
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root/$fastcgi_script_name;
}
# or alternatively if you use uwsgi
# location ~ \.php$ {
# include uwsgi_params;
# uwsgi_modifier1 14;
# uwsgi_pass unix:/run/uwsgi/grav.sock;
# }
## End - PHP
}

## Begin - Static content
location ~ \.(?:css|js|svg|gif|jpe?g|png|woff2?)$ {
expires 7d;
access_log off;
}
## End - Static content
}