2025-11-04
This commit is contained in:
parent
e4eaf6404a
commit
66397de267
101 changed files with 2573 additions and 58 deletions
723
containers/conf/angie/snippets/bots-map.conf-example
Executable file
723
containers/conf/angie/snippets/bots-map.conf-example
Executable file
|
|
@ -0,0 +1,723 @@
|
|||
## Map user agent string
|
||||
## Include this file in your serverblock
|
||||
## Include bots.conf in your global config
|
||||
|
||||
map $http_user_agent $bad_client {
|
||||
default 0;
|
||||
01h4x.com 1;
|
||||
360Spider 1;
|
||||
404checker 1;
|
||||
404enemy 1;
|
||||
80legs 1;
|
||||
ADmantX 1;
|
||||
AIBOT 1;
|
||||
ALittle\ 1;
|
||||
Client 1;
|
||||
ASPSeek 1;
|
||||
Abonti 1;
|
||||
Aboundex 1;
|
||||
Aboundexbot 1;
|
||||
Acunetix 1;
|
||||
AdsTxtCrawlerTP 1;
|
||||
AfD-Verbotsverfahren 1;
|
||||
AhrefsBot 1;
|
||||
AiHitBot 1;
|
||||
Aipbot 1;
|
||||
Alexibot 1;
|
||||
AllSubmitter 1;
|
||||
Alligator 1;
|
||||
AlphaBot 1;
|
||||
Anarchie 1;
|
||||
Anarchy 1;
|
||||
Anarchy99 1;
|
||||
Ankit 1;
|
||||
Anthill 1;
|
||||
Apexoo 1;
|
||||
Aspiegel 1;
|
||||
Asterias 1;
|
||||
Atomseobot 1;
|
||||
Attach 1;
|
||||
AwarioRssBot 1;
|
||||
AwarioSmartBot 1;
|
||||
BBBike 1;
|
||||
BDCbot 1;
|
||||
BDFetch 1;
|
||||
BLEXBot 1;
|
||||
BackDoorBot 1;
|
||||
BackStreet 1;
|
||||
BackWeb 1;
|
||||
Backlink-Ceck 1;
|
||||
BacklinkCrawler 1;
|
||||
Badass 1;
|
||||
Bandit 1;
|
||||
Barkrowler 1;
|
||||
BatchFTP 1;
|
||||
Battleztar\ 1;
|
||||
Bazinga 1;
|
||||
BetaBot 1;
|
||||
Bigfoot 1;
|
||||
Bitacle 1;
|
||||
BlackWidow 1;
|
||||
Black\ 1;
|
||||
Hole 1;
|
||||
Blackboard 1;
|
||||
Blow 1;
|
||||
BlowFish 1;
|
||||
Boardreader 1;
|
||||
Bolt 1;
|
||||
BotALot 1;
|
||||
Brandprotect 1;
|
||||
Brandwatch 1;
|
||||
Buck 1;
|
||||
Buddy 1;
|
||||
BuiltBotTough 1;
|
||||
BuiltWith 1;
|
||||
Bullseye 1;
|
||||
BunnySlippers 1;
|
||||
BuzzSumo 1;
|
||||
Bytespider 1;
|
||||
CATExplorador 1;
|
||||
CCBot 1;
|
||||
CODE87 1;
|
||||
CSHttp 1;
|
||||
Calculon 1;
|
||||
CazoodleBot 1;
|
||||
Cegbfeieh 1;
|
||||
CensysInspect 1;
|
||||
CheTeam 1;
|
||||
CheeseBot 1;
|
||||
CherryPicker 1;
|
||||
ChinaClaw 1;
|
||||
Chlooe 1;
|
||||
Citoid 1;
|
||||
Claritybot 1;
|
||||
Cliqzbot 1;
|
||||
Cloud\ 1;
|
||||
mapping 1;
|
||||
Cocolyzebot 1;
|
||||
Cogentbot 1;
|
||||
Collector 1;
|
||||
Copier 1;
|
||||
CopyRightCheck 1;
|
||||
Copyscape 1;
|
||||
Cosmos 1;
|
||||
Craftbot 1;
|
||||
Crawling\ 1;
|
||||
at\ 1;
|
||||
Home\ 1;
|
||||
Project 1;
|
||||
CrazyWebCrawler 1;
|
||||
Crescent 1;
|
||||
CrunchBot 1;
|
||||
Curious 1;
|
||||
Custo 1;
|
||||
CyotekWebCopy 1;
|
||||
DBLBot 1;
|
||||
DIIbot 1;
|
||||
DSearch 1;
|
||||
DTS\ 1;
|
||||
Agent 1;
|
||||
DataCha0s 1;
|
||||
DatabaseDriverMysqli 1;
|
||||
Demon 1;
|
||||
Deusu 1;
|
||||
Devil 1;
|
||||
Digincore 1;
|
||||
DigitalPebble 1;
|
||||
Dirbuster 1;
|
||||
Disco 1;
|
||||
Discobot 1;
|
||||
Discoverybot 1;
|
||||
Dispatch 1;
|
||||
DittoSpyder 1;
|
||||
DnBCrawler-Analytics 1;
|
||||
DnyzBot 1;
|
||||
DomCopBot 1;
|
||||
DomainAppender 1;
|
||||
DomainCrawler 1;
|
||||
DomainSigmaCrawler 1;
|
||||
DomainStatsBot 1;
|
||||
Domains\ 1;
|
||||
Project 1;
|
||||
Dotbot 1;
|
||||
Download\ 1;
|
||||
Wonder 1;
|
||||
Dragonfly 1;
|
||||
Drip 1;
|
||||
ECCP/1.0 1;
|
||||
EMail\ 1;
|
||||
Siphon 1;
|
||||
EMail\ 1;
|
||||
Wolf 1;
|
||||
EasyDL 1;
|
||||
Ebingbong 1;
|
||||
Ecxi 1;
|
||||
EirGrabber 1;
|
||||
EroCrawler 1;
|
||||
Evil 1;
|
||||
Exabot 1;
|
||||
Express\ 1;
|
||||
WebPictures 1;
|
||||
ExtLinksBot 1;
|
||||
Extractor 1;
|
||||
ExtractorPro 1;
|
||||
Extreme\ 1;
|
||||
Picture\ 1;
|
||||
Finder 1;
|
||||
EyeNetIE 1;
|
||||
Ezooms 1;
|
||||
FDM 1;
|
||||
FHscan 1;
|
||||
FemtosearchBot 1;
|
||||
Fimap 1;
|
||||
Firefox/7.0 1;
|
||||
FlashGet 1;
|
||||
Flunky 1;
|
||||
Foobot 1;
|
||||
Freeuploader 1;
|
||||
FrontPage 1;
|
||||
Fuzz 1;
|
||||
FyberSpider 1;
|
||||
Fyrebot 1;
|
||||
G-i-g-a-b-o-t 1;
|
||||
GPTBot 1;
|
||||
GT::WWW 1;
|
||||
GalaxyBot 1;
|
||||
Genieo 1;
|
||||
GermCrawler 1;
|
||||
GetRight 1;
|
||||
GetWeb 1;
|
||||
Getintent 1;
|
||||
Gigabot 1;
|
||||
Go!Zilla 1;
|
||||
Go-Ahead-Got-It 1;
|
||||
GoZilla 1;
|
||||
Gotit 1;
|
||||
GrabNet 1;
|
||||
Grabber 1;
|
||||
Grafula 1;
|
||||
GrapeFX 1;
|
||||
GrapeshotCrawler 1;
|
||||
GridBot 1;
|
||||
HEADMasterSEO 1;
|
||||
HMView 1;
|
||||
HTMLparser 1;
|
||||
HTTP::Lite 1;
|
||||
HTTrack 1;
|
||||
Haansoft 1;
|
||||
HaosouSpider 1;
|
||||
Harvest 1;
|
||||
Havij 1;
|
||||
Heritrix 1;
|
||||
Hloader 1;
|
||||
HonoluluBot 1;
|
||||
Humanlinks 1;
|
||||
HybridBot 1;
|
||||
IDBTE4M 1;
|
||||
IDBot 1;
|
||||
IRLbot 1;
|
||||
Iblog 1;
|
||||
Id-search 1;
|
||||
IlseBot 1;
|
||||
Image\ 1;
|
||||
Fetch 1;
|
||||
Image\ 1;
|
||||
Sucker 1;
|
||||
IndeedBot 1;
|
||||
Indy\ 1;
|
||||
Library 1;
|
||||
InfoNaviRobot 1;
|
||||
InfoTekies 1;
|
||||
Intelliseek 1;
|
||||
InterGET 1;
|
||||
InternetSeer 1;
|
||||
Internet\ 1;
|
||||
Ninja 1;
|
||||
Iria 1;
|
||||
Iskanie 1;
|
||||
IstellaBot 1;
|
||||
JOC\ 1;
|
||||
Web\ 1;
|
||||
Spider 1;
|
||||
JamesBOT 1;
|
||||
Jbrofuzz 1;
|
||||
JennyBot 1;
|
||||
JetCar 1;
|
||||
Jetty 1;
|
||||
JikeSpider 1;
|
||||
Joomla 1;
|
||||
Jorgee 1;
|
||||
JustView 1;
|
||||
Jyxobot 1;
|
||||
Kenjin\ 1;
|
||||
Spider 1;
|
||||
Keybot\ 1;
|
||||
Translation-Search-Machine 1;
|
||||
Keyword\ 1;
|
||||
Density 1;
|
||||
Kinza 1;
|
||||
Kozmosbot 1;
|
||||
LNSpiderguy 1;
|
||||
LWP::Simple 1;
|
||||
Lanshanbot 1;
|
||||
Larbin 1;
|
||||
Leap 1;
|
||||
LeechFTP 1;
|
||||
LeechGet 1;
|
||||
LexiBot 1;
|
||||
Lftp 1;
|
||||
LibWeb 1;
|
||||
Libwhisker 1;
|
||||
LieBaoFast 1;
|
||||
Lightspeedsystems 1;
|
||||
Likse 1;
|
||||
LinkScan 1;
|
||||
LinkWalker 1;
|
||||
Linkbot 1;
|
||||
LinkextractorPro 1;
|
||||
LinkpadBot 1;
|
||||
LinksManager 1;
|
||||
LinqiaMetadataDownloaderBot 1;
|
||||
LinqiaRSSBot 1;
|
||||
LinqiaScrapeBot 1;
|
||||
Lipperhey 1;
|
||||
Lipperhey\ 1;
|
||||
Spider 1;
|
||||
Litemage_walker 1;
|
||||
Lmspider 1;
|
||||
Ltx71 1;
|
||||
MFC_Tear_Sample 1;
|
||||
MIDown\ 1;
|
||||
tool 1;
|
||||
MIIxpc 1;
|
||||
MJ12bot 1;
|
||||
MQQBrowser 1;
|
||||
MSFrontPage 1;
|
||||
MSIECrawler 1;
|
||||
MTRobot 1;
|
||||
Mag-Net 1;
|
||||
Magnet 1;
|
||||
Mail.RU_Bot 1;
|
||||
Majestic-SEO 1;
|
||||
Majestic12 1;
|
||||
Majestic\ 1;
|
||||
SEO 1;
|
||||
MarkMonitor 1;
|
||||
MarkWatch 1;
|
||||
Mass\ 1;
|
||||
Downloader 1;
|
||||
Masscan 1;
|
||||
Mata\ 1;
|
||||
Hari 1;
|
||||
MauiBot 1;
|
||||
Mb2345Browser 1;
|
||||
MeanPath\ 1;
|
||||
Bot 1;
|
||||
Meanpathbot 1;
|
||||
Mediatoolkitbot 1;
|
||||
MegaIndex.ru 1;
|
||||
Metauri 1;
|
||||
MicroMessenger 1;
|
||||
Microsoft\ 1;
|
||||
Data\ 1;
|
||||
Access 1;
|
||||
Microsoft\ 1;
|
||||
URL\ 1;
|
||||
Control 1;
|
||||
Minefield 1;
|
||||
Mister\ 1;
|
||||
PiX 1;
|
||||
Moblie\ 1;
|
||||
Safari 1;
|
||||
Mojeek 1;
|
||||
Mojolicious 1;
|
||||
MolokaiBot 1;
|
||||
Morfeus\ 1;
|
||||
Fucking\ 1;
|
||||
Scanner 1;
|
||||
Mozlila 1;
|
||||
Mr.4x3 1;
|
||||
Msrabot 1;
|
||||
Musobot 1;
|
||||
NICErsPRO 1;
|
||||
NPbot 1;
|
||||
Name\ 1;
|
||||
Intelligence 1;
|
||||
Nameprotect 1;
|
||||
Navroad 1;
|
||||
NearSite 1;
|
||||
Needle 1;
|
||||
Nessus 1;
|
||||
NetAnts 1;
|
||||
NetLyzer 1;
|
||||
NetMechanic 1;
|
||||
NetSpider 1;
|
||||
NetZIP 1;
|
||||
Net\ 1;
|
||||
Vampire 1;
|
||||
Netcraft 1;
|
||||
Nettrack 1;
|
||||
Netvibes 1;
|
||||
NextGenSearchBot 1;
|
||||
Nibbler 1;
|
||||
Niki-bot 1;
|
||||
Nikto 1;
|
||||
NimbleCrawler 1;
|
||||
Nimbostratus 1;
|
||||
Ninja 1;
|
||||
Nmap 1;
|
||||
Nuclei 1;
|
||||
Nutch 1;
|
||||
Octopus 1;
|
||||
Offline\ 1;
|
||||
Explorer 1;
|
||||
Offline\ 1;
|
||||
Navigator 1;
|
||||
OnCrawl 1;
|
||||
OpenLinkProfiler 1;
|
||||
OpenVAS 1;
|
||||
Openfind 1;
|
||||
Openvas 1;
|
||||
OrangeBot 1;
|
||||
OrangeSpider 1;
|
||||
OutclicksBot 1;
|
||||
OutfoxBot 1;
|
||||
PECL::HTTP 1;
|
||||
PHPCrawl 1;
|
||||
POE-Component-Client-HTTP 1;
|
||||
PageAnalyzer 1;
|
||||
PageGrabber 1;
|
||||
PageScorer 1;
|
||||
PageThing.com 1;
|
||||
Page\ 1;
|
||||
Analyzer 1;
|
||||
Pandalytics 1;
|
||||
Panscient 1;
|
||||
Papa\ 1;
|
||||
Foto 1;
|
||||
Pavuk 1;
|
||||
PeoplePal 1;
|
||||
Petalbot 1;
|
||||
Pi-Monster 1;
|
||||
Picscout 1;
|
||||
Picsearch 1;
|
||||
PictureFinder 1;
|
||||
Piepmatz 1;
|
||||
Pimonster 1;
|
||||
Pixray 1;
|
||||
PleaseCrawl 1;
|
||||
Pockey 1;
|
||||
ProPowerBot 1;
|
||||
ProWebWalker 1;
|
||||
Probethenet 1;
|
||||
Proximic 1;
|
||||
Psbot 1;
|
||||
Pu_iN 1;
|
||||
Pump 1;
|
||||
PxBroker 1;
|
||||
PyCurl 1;
|
||||
QueryN\ 1;
|
||||
Metasearch 1;
|
||||
Quick-Crawler 1;
|
||||
RSSingBot 1;
|
||||
Rainbot 1;
|
||||
RankActive 1;
|
||||
RankActiveLinkBot 1;
|
||||
RankFlex 1;
|
||||
RankingBot 1;
|
||||
RankingBot2 1;
|
||||
Rankivabot 1;
|
||||
RankurBot 1;
|
||||
Re-re 1;
|
||||
ReGet 1;
|
||||
RealDownload 1;
|
||||
Reaper 1;
|
||||
RebelMouse 1;
|
||||
Recorder 1;
|
||||
RedesScrapy 1;
|
||||
RepoMonkey 1;
|
||||
Ripper 1;
|
||||
RocketCrawler 1;
|
||||
Rogerbot 1;
|
||||
SBIder 1;
|
||||
SEOkicks 1;
|
||||
SEOkicks-Robot 1;
|
||||
SEOlyticsCrawler 1;
|
||||
SEOprofiler 1;
|
||||
SEOstats 1;
|
||||
SISTRIX 1;
|
||||
SMTBot 1;
|
||||
SalesIntelligent 1;
|
||||
ScanAlert 1;
|
||||
Scanbot 1;
|
||||
ScoutJet 1;
|
||||
Scrapy 1;
|
||||
Screaming 1;
|
||||
ScreenerBot 1;
|
||||
ScrepyBot 1;
|
||||
Searchestate 1;
|
||||
SearchmetricsBot 1;
|
||||
Seekport 1;
|
||||
SeekportBot 1;
|
||||
SemanticJuice 1;
|
||||
Semrush 1;
|
||||
SemrushBot 1;
|
||||
SentiBot 1;
|
||||
SenutoBot 1;
|
||||
SeoSiteCheckup 1;
|
||||
SeobilityBot 1;
|
||||
Seomoz 1;
|
||||
Shodan 1;
|
||||
Siphon 1;
|
||||
SiteCheckerBotCrawler 1;
|
||||
SiteExplorer 1;
|
||||
SiteLockSpider 1;
|
||||
SiteSnagger 1;
|
||||
SiteSucker 1;
|
||||
Site\ 1;
|
||||
Sucker 1;
|
||||
Sitebeam 1;
|
||||
Siteimprove 1;
|
||||
Sitevigil 1;
|
||||
SlySearch 1;
|
||||
SmartDownload 1;
|
||||
Snake 1;
|
||||
Snapbot 1;
|
||||
Snoopy 1;
|
||||
SocialRankIOBot 1;
|
||||
Sociscraper 1;
|
||||
Sogou\ 1;
|
||||
web\ 1;
|
||||
spider 1;
|
||||
Sosospider 1;
|
||||
Sottopop 1;
|
||||
SpaceBison 1;
|
||||
Spammen 1;
|
||||
SpankBot 1;
|
||||
Spanner 1;
|
||||
Spbot 1;
|
||||
Spinn3r 1;
|
||||
SputnikBot 1;
|
||||
Sqlmap 1;
|
||||
Sqlworm 1;
|
||||
Sqworm 1;
|
||||
Steeler 1;
|
||||
Stripper 1;
|
||||
Sucker 1;
|
||||
Sucuri 1;
|
||||
SuperBot 1;
|
||||
SuperHTTP 1;
|
||||
Surfbot 1;
|
||||
SurveyBot 1;
|
||||
Suzuran 1;
|
||||
Swiftbot 1;
|
||||
Szukacz 1;
|
||||
T0PHackTeam 1;
|
||||
T8Abot 1;
|
||||
Teleport 1;
|
||||
TeleportPro 1;
|
||||
Telesoft 1;
|
||||
Telesphoreo 1;
|
||||
Telesphorep 1;
|
||||
TheNomad 1;
|
||||
The\ 1;
|
||||
Intraformant 1;
|
||||
Thumbor 1;
|
||||
TightTwatBot 1;
|
||||
TinyTestBot 1;
|
||||
Titan 1;
|
||||
Toata 1;
|
||||
Toweyabot 1;
|
||||
Tracemyfile 1;
|
||||
Trendiction 1;
|
||||
Trendictionbot 1;
|
||||
True_Robot 1;
|
||||
Turingos 1;
|
||||
Turnitin 1;
|
||||
TurnitinBot 1;
|
||||
TwengaBot 1;
|
||||
Twice 1;
|
||||
Typhoeus 1;
|
||||
URLy.Warning 1;
|
||||
URLy\ 1;
|
||||
Warning 1;
|
||||
UnisterBot 1;
|
||||
Upflow 1;
|
||||
V-BOT 1;
|
||||
VB\ 1;
|
||||
Project 1;
|
||||
VCI 1;
|
||||
Vacuum 1;
|
||||
Vagabondo 1;
|
||||
VelenPublicWebCrawler 1;
|
||||
VeriCiteCrawler 1;
|
||||
VidibleScraper 1;
|
||||
Virusdie 1;
|
||||
VoidEYE 1;
|
||||
Voil 1;
|
||||
Voltron 1;
|
||||
WASALive-Bot 1;
|
||||
WBSearchBot 1;
|
||||
WEBDAV 1;
|
||||
WISENutbot 1;
|
||||
WPScan 1;
|
||||
WWW-Collector-E 1;
|
||||
WWW-Mechanize 1;
|
||||
WWW::Mechanize 1;
|
||||
WWWOFFLE 1;
|
||||
Wallpapers 1;
|
||||
Wallpapers/3.0 1;
|
||||
WallpapersHD 1;
|
||||
WeSEE 1;
|
||||
WebAuto 1;
|
||||
WebBandit 1;
|
||||
WebCollage 1;
|
||||
WebCopier 1;
|
||||
WebEnhancer 1;
|
||||
WebFetch 1;
|
||||
WebFuck 1;
|
||||
WebGo\ 1;
|
||||
IS 1;
|
||||
WebImageCollector 1;
|
||||
WebLeacher 1;
|
||||
WebPix 1;
|
||||
WebReaper 1;
|
||||
WebSauger 1;
|
||||
WebStripper 1;
|
||||
WebSucker 1;
|
||||
WebWhacker 1;
|
||||
WebZIP 1;
|
||||
Web\ 1;
|
||||
Auto 1;
|
||||
Web\ 1;
|
||||
Collage 1;
|
||||
Web\ 1;
|
||||
Enhancer 1;
|
||||
Web\ 1;
|
||||
Fetch 1;
|
||||
Web\ 1;
|
||||
Fuck 1;
|
||||
Web\ 1;
|
||||
Pix 1;
|
||||
Web\ 1;
|
||||
Sauger 1;
|
||||
Web\ 1;
|
||||
Sucker 1;
|
||||
Webalta 1;
|
||||
WebmasterWorldForumBot 1;
|
||||
Webshag 1;
|
||||
WebsiteExtractor 1;
|
||||
WebsiteQuester 1;
|
||||
Website\ 1;
|
||||
Quester 1;
|
||||
Webster 1;
|
||||
Whack 1;
|
||||
Whacker 1;
|
||||
Whatweb 1;
|
||||
Who.is\ 1;
|
||||
Bot 1;
|
||||
Widow 1;
|
||||
WinHTTrack 1;
|
||||
WiseGuys\ 1;
|
||||
Robot 1;
|
||||
Wonderbot 1;
|
||||
Woobot 1;
|
||||
Wotbox 1;
|
||||
Wprecon 1;
|
||||
Xaldon\ 1;
|
||||
WebSpider 1;
|
||||
Xaldon_WebSpider 1;
|
||||
Xenu 1;
|
||||
YoudaoBot 1;
|
||||
Zade 1;
|
||||
Zauba 1;
|
||||
Zermelo 1;
|
||||
Zeus 1;
|
||||
Zitebot 1;
|
||||
ZmEu 1;
|
||||
ZoomBot 1;
|
||||
ZoominfoBot 1;
|
||||
ZumBot 1;
|
||||
ZyBorg 1;
|
||||
adscanner 1;
|
||||
archive.org_bot 1;
|
||||
arquivo-web-crawler 1;
|
||||
arquivo.pt 1;
|
||||
autoemailspider 1;
|
||||
backlink-check 1;
|
||||
cah.io.community 1;
|
||||
check1.exe 1;
|
||||
clark-crawler 1;
|
||||
coccocbot 1;
|
||||
cognitiveseo 1;
|
||||
com.plumanalytics 1;
|
||||
crawl.sogou.com 1;
|
||||
crawler.feedback 1;
|
||||
crawler4j 1;
|
||||
dataforseo.com 1;
|
||||
dataforseobot 1;
|
||||
demandbase-bot 1;
|
||||
domainsproject.org 1;
|
||||
eCatch 1;
|
||||
evc-batch 1;
|
||||
facebookscraper 1;
|
||||
gopher 1;
|
||||
heritrix 1;
|
||||
instabid 1;
|
||||
internetVista\ 1;
|
||||
monitor 1;
|
||||
ips-agent 1;
|
||||
isitwp.com 1;
|
||||
iubenda-radar 1;
|
||||
linkdexbot 1;
|
||||
lwp-request 1;
|
||||
lwp-trivial 1;
|
||||
magpie-crawler 1;
|
||||
meanpathbot 1;
|
||||
mediawords 1;
|
||||
muhstik-scan 1;
|
||||
netEstate\ 1;
|
||||
NE\ 1;
|
||||
Crawler 1;
|
||||
oBot 1;
|
||||
openai 1;
|
||||
openai.com 1;
|
||||
page\ 1;
|
||||
scorer 1;
|
||||
pcBrowser 1;
|
||||
plumanalytics 1;
|
||||
polaris\ 1;
|
||||
version 1;
|
||||
probe-image-size 1;
|
||||
ripz 1;
|
||||
s1z.ru 1;
|
||||
satoristudio.net 1;
|
||||
scalaj-http 1;
|
||||
scan.lol 1;
|
||||
seobility 1;
|
||||
seocompany.store 1;
|
||||
seoscanners 1;
|
||||
seostar 1;
|
||||
serpstatbot 1;
|
||||
sexsearcher 1;
|
||||
sitechecker.pro 1;
|
||||
siteripz 1;
|
||||
sogouspider 1;
|
||||
sp_auditbot 1;
|
||||
spyfu 1;
|
||||
sysscan 1;
|
||||
tAkeOut 1;
|
||||
trendiction.com 1;
|
||||
trendiction.de 1;
|
||||
ubermetrics-technologies.com 1;
|
||||
voyagerx.com 1;
|
||||
webgains-bot 1;
|
||||
webmeup-crawler 1;
|
||||
webpros.com 1;
|
||||
webprosbot 1;
|
||||
x09Mozilla 1;
|
||||
x22Mozilla 1;
|
||||
xpymep1.exe 1;
|
||||
zauba.io 1;
|
||||
zgrab 1;
|
||||
}
|
||||
20
containers/conf/angie/snippets/bots.conf-example
Executable file
20
containers/conf/angie/snippets/bots.conf-example
Executable file
|
|
@ -0,0 +1,20 @@
|
|||
|
||||
# Use this with maps.conf in nginx.conf
|
||||
# include this in your vhost/location
|
||||
|
||||
# Return Code 410 is special, it says the content is deleted, indexers *should* their content.
|
||||
|
||||
#see maps.conf
|
||||
if ($bad_client) { return 410; }
|
||||
|
||||
# Tailored for Magento 1 and layered navigation
|
||||
## Dont let search bots to drill your website | exclude some args from indexing
|
||||
#if ($args ~ ^(brand|cat|color|dir|from|limit|price|type|mode|size|manufacturer)=.+) { set $filters A; }
|
||||
#if ($http_user_agent ~* "http|bot|crawl|spider|Google|bing|Yahoo|Yandex") { set $filters "${filters}B"; }
|
||||
#if ($filters = AB) { return 410; }
|
||||
|
||||
#uncomment this if you don't want to be indexed by google/yahoo/yandex/bing etc
|
||||
#if ($http_user_agent ~* "Bot|Google|Bing|Yahoo|Yandex") {
|
||||
# return 410;
|
||||
#}
|
||||
|
||||
26
containers/conf/angie/snippets/cloudflare.conf
Executable file
26
containers/conf/angie/snippets/cloudflare.conf
Executable file
|
|
@ -0,0 +1,26 @@
|
|||
# Include this file in your vhost
|
||||
|
||||
set_real_ip_from 173.245.48.0/20;
|
||||
set_real_ip_from 103.21.244.0/22;
|
||||
set_real_ip_from 103.22.200.0/22;
|
||||
set_real_ip_from 103.31.4.0/22;
|
||||
set_real_ip_from 141.101.64.0/18;
|
||||
set_real_ip_from 108.162.192.0/18;
|
||||
set_real_ip_from 190.93.240.0/20;
|
||||
set_real_ip_from 188.114.96.0/20;
|
||||
set_real_ip_from 197.234.240.0/22;
|
||||
set_real_ip_from 198.41.128.0/17;
|
||||
set_real_ip_from 162.158.0.0/15;
|
||||
set_real_ip_from 104.16.0.0/13;
|
||||
set_real_ip_from 104.24.0.0/14;
|
||||
set_real_ip_from 172.64.0.0/13;
|
||||
set_real_ip_from 131.0.72.0/22;
|
||||
set_real_ip_from 2400:cb00::/32;
|
||||
set_real_ip_from 2606:4700::/32;
|
||||
set_real_ip_from 2803:f800::/32;
|
||||
set_real_ip_from 2405:b500::/32;
|
||||
set_real_ip_from 2405:8100::/32;
|
||||
set_real_ip_from 2a06:98c0::/29;
|
||||
set_real_ip_from 2c0f:f248::/32;
|
||||
|
||||
real_ip_header CF-Connecting-IP;
|
||||
13
containers/conf/angie/snippets/fastcgi-php.conf
Executable file
13
containers/conf/angie/snippets/fastcgi-php.conf
Executable file
|
|
@ -0,0 +1,13 @@
|
|||
# regex to split $uri to $fastcgi_script_name and $fastcgi_path
|
||||
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
|
||||
|
||||
# Check that the PHP script exists before passing it
|
||||
try_files $fastcgi_script_name =404;
|
||||
|
||||
# Bypass the fact that try_files resets $fastcgi_path_info
|
||||
# see: http://trac.nginx.org/nginx/ticket/321
|
||||
set $path_info $fastcgi_path_info;
|
||||
fastcgi_param PATH_INFO $path_info;
|
||||
|
||||
fastcgi_index index.php;
|
||||
include fastcgi.conf;
|
||||
14
containers/conf/angie/snippets/http3.txt
Executable file
14
containers/conf/angie/snippets/http3.txt
Executable file
|
|
@ -0,0 +1,14 @@
|
|||
|
||||
So, you want http3?
|
||||
|
||||
This is a quick & dirty howto.
|
||||
|
||||
1. Open port 443/udp to your nginx instance
|
||||
2. Put http3 on; in nginx.conf. (and additional http2 on; but not required)
|
||||
3. Add Listen 443 quic; to your ssl interface
|
||||
4. Put the following in your serverblock (in location /) add_header Alt-Svc 'h3=":443"'; # Advertise that HTTP/3 is available
|
||||
5. Check with nginx -t if everything is alright
|
||||
6. Restart nginx
|
||||
7. Check with curl or an online http3 checker
|
||||
|
||||
Please note, the nginx from http://deb.myguard.nl is compiled with OpenSSL3.0.x+quic, you should install the custom OpenSSL from deb.myguard.nl as well if not done automaticly.
|
||||
48
containers/conf/angie/snippets/letsencrypt-redirect.conf
Executable file
48
containers/conf/angie/snippets/letsencrypt-redirect.conf
Executable file
|
|
@ -0,0 +1,48 @@
|
|||
#############################################################################
|
||||
# Configuration file for Let's Encrypt ACME Challenge location
|
||||
# This file is already included in listen_xxx.conf files.
|
||||
# Do NOT include it separately!
|
||||
#############################################################################
|
||||
#
|
||||
# This config enables to access /.well-known/acme-challenge/xxxxxxxxxxx
|
||||
# on all our sites (HTTP), including all subdomains.
|
||||
# This is required by ACME Challenge (webroot authentication).
|
||||
# You can check that this location is working by placing ping.txt here:
|
||||
# /var/www/letsencrypt/.well-known/acme-challenge/ping.txt
|
||||
# And pointing your browser to:
|
||||
# http://xxx.domain.tld/.well-known/acme-challenge/ping.txt
|
||||
#
|
||||
# Sources:
|
||||
# https://community.letsencrypt.org/t/howto-easy-cert-generation-and-renewal-with-nginx/3491
|
||||
#
|
||||
#############################################################################
|
||||
|
||||
# Rule for legitimate ACME Challenge requests (like /.well-known/acme-challenge/xxxxxxxxx)
|
||||
# We use ^~ here, so that we don't check other regexes (for speed-up). We actually MUST cancel
|
||||
# other regex checks, because in our other config files have regex rule that denies access to files with dotted names.
|
||||
location ^~ /.well-known/acme-challenge/ {
|
||||
|
||||
allow all;
|
||||
auth_basic off;
|
||||
|
||||
# Set correct content type. According to this:
|
||||
# https://community.letsencrypt.org/t/using-the-webroot-domain-verification-method/1445/29
|
||||
# Current specification requires "text/plain" or no content header at all.
|
||||
# It seems that "text/plain" is a safe option.
|
||||
default_type "text/plain";
|
||||
|
||||
# This directory must be the same as in /etc/letsencrypt/cli.ini
|
||||
# as "webroot-path" parameter. Also don't forget to set "authenticator" parameter
|
||||
# there to "webroot".
|
||||
# Do NOT use alias, use root! Target directory is located here:
|
||||
# /var/www/common/letsencrypt/.well-known/acme-challenge/
|
||||
root /var/www/html;
|
||||
|
||||
}
|
||||
|
||||
# Hide /acme-challenge subdirectory and return 404 on all requests.
|
||||
# It is somewhat more secure than letting Nginx return 403.
|
||||
# Ending slash is important!
|
||||
# location = /.well-known/acme-challenge/ {
|
||||
# return 404;
|
||||
# }
|
||||
91
containers/conf/angie/snippets/libmodsecurity-global.conf.example
Executable file
91
containers/conf/angie/snippets/libmodsecurity-global.conf.example
Executable file
|
|
@ -0,0 +1,91 @@
|
|||
modsecurity on;
|
||||
|
||||
modsecurity_rules '
|
||||
SecRuleEngine On
|
||||
#SecDebugLog /tmp/modsec_debug.log
|
||||
#SecDebugLogLevel 9
|
||||
#SecRuleRemoveById 10
|
||||
#SecDataDir /var/cache/modsecurity
|
||||
';
|
||||
|
||||
|
||||
modsecurity_rules_file /etc/modsecurity/modsecurity.conf;
|
||||
modsecurity_rules_file /etc/modsecurity/ownrules.conf;
|
||||
|
||||
#CRS
|
||||
#modsecurity_rules_file /etc/modsecurity/crs/crs-setup.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/crs/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-901-INITIALIZATION.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-903.9003-NEXTCLOUD-EXCLUSION-RULES.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-903.9004-DOKUWIKI-EXCLUSION-RULES.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-903.9005-CPANEL-EXCLUSION-RULES.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-905-COMMON-EXCEPTIONS.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-910-IP-REPUTATION.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-911-METHOD-ENFORCEMENT.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-912-DOS-PROTECTION.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-913-SCANNER-DETECTION.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-920-PROTOCOL-ENFORCEMENT.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-921-PROTOCOL-ATTACK.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-930-APPLICATION-ATTACK-LFI.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-931-APPLICATION-ATTACK-RFI.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-932-APPLICATION-ATTACK-RCE.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-933-APPLICATION-ATTACK-PHP.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-941-APPLICATION-ATTACK-XSS.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-942-APPLICATION-ATTACK-SQLI.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-944-APPLICATION-ATTACK-JAVA.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-949-BLOCKING-EVALUATION.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/RESPONSE-950-DATA-LEAKAGES.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/RESPONSE-951-DATA-LEAKAGES-SQL.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/RESPONSE-952-DATA-LEAKAGES-JAVA.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/RESPONSE-953-DATA-LEAKAGES-PHP.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/RESPONSE-954-DATA-LEAKAGES-IIS.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/RESPONSE-959-BLOCKING-EVALUATION.conf;
|
||||
#modsecurity_rules_file /usr/share/modsecurity-crs/RESPONSE-980-CORRELATION.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/crs/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf;
|
||||
|
||||
#
|
||||
##https://waf.comodo.com/
|
||||
#
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/00_Init_Initialization.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/01_Init_AppsInitialization.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/02_Global_Generic.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/03_Global_Agents.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/04_Global_Domains.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/05_Global_Incoming.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/06_Global_Backdoor.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/07_XSS_XSS.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/08_Global_Other.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/09_Bruteforce_Bruteforce.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/10_HTTP_HTTP.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/11_HTTP_HTTPDoS.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/12_HTTP_Protocol.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/13_HTTP_Request.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/14_Outgoing_FilterGen.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/15_Outgoing_FilterASP.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/16_Outgoing_FilterPHP.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/17_Outgoing_FilterSQL.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/18_Outgoing_FilterOther.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/19_Outgoing_FilterInFrame.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/20_Outgoing_FiltersEnd.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/21_PHP_PHPGen.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/22_SQL_SQLi.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/23_ROR_RORGen.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/24_Apps_Joomla.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/25_Apps_JComponent.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/26_Apps_WordPress.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/27_Apps_WPPlugin.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/28_Apps_WHMCS.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/29_Apps_Drupal.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/30_Apps_OtherApps.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/categories.conf;
|
||||
|
||||
|
||||
#https://github.com/Rev3rseSecurity/wordpress-modsecurity-ruleset
|
||||
#modsecurity_rules_file /etc/modsecurity/wordpress-modsecurity-ruleset/01-SETUP.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/wordpress-modsecurity-ruleset/02-INITIALIZATION.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/wordpress-modsecurity-ruleset/03-BRUTEFORCE.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/wordpress-modsecurity-ruleset/04-EVENTS.conf;
|
||||
#modsecurity_rules_file /etc/modsecurity/wordpress-modsecurity-ruleset/05-HARDENING.conf;
|
||||
10
containers/conf/angie/snippets/lua.conf-example
Executable file
10
containers/conf/angie/snippets/lua.conf-example
Executable file
|
|
@ -0,0 +1,10 @@
|
|||
|
||||
# When using openresty's lua, you have to include this in your http {} block
|
||||
|
||||
lua_package_path "/usr/share/lua/5.1/?.lua;;";
|
||||
|
||||
init_by_lua_block {
|
||||
require "resty.core"
|
||||
collectgarbage("collect") -- just to collect any garbage
|
||||
}
|
||||
|
||||
3
containers/conf/angie/snippets/nginx_module_vts.conf-example
Executable file
3
containers/conf/angie/snippets/nginx_module_vts.conf-example
Executable file
|
|
@ -0,0 +1,3 @@
|
|||
see https://github.com/vozlt/nginx-module-vts/
|
||||
|
||||
If you want to contribute a sane config, please submit it
|
||||
35
containers/conf/angie/snippets/proxy.conf-example
Executable file
35
containers/conf/angie/snippets/proxy.conf-example
Executable file
|
|
@ -0,0 +1,35 @@
|
|||
#include this in the location of your vhost you want to proxy
|
||||
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header Scheme $scheme;
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-Host $http_host;
|
||||
proxy_set_header REMOTE_ADDR $remote_addr;
|
||||
proxy_set_header HTTP_CF_CONNECTING_IP $remote_addr;
|
||||
proxy_set_header Early-Data $ssl_early_data;
|
||||
|
||||
add_header Front-End-Https on;
|
||||
|
||||
proxy_redirect off;
|
||||
proxy_buffering off;
|
||||
|
||||
proxy_buffer_size 128k;
|
||||
proxy_buffers 4 256k;
|
||||
proxy_busy_buffers_size 256k;
|
||||
|
||||
proxy_ssl_verify off;
|
||||
proxy_ssl_session_reuse on;
|
||||
proxy_ssl_protocols TLSv1.3 TLSv1.2;
|
||||
|
||||
# WebSocket stuff
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
|
||||
# Prevent application/json content from being cached (Breaks nzbget and possibly others)
|
||||
# more_set_headers -t "application/json" "Last-Modified $date_gmt";
|
||||
# more_set_headers -t "application/json" "Expect-CT 'max-age=0; enforce'";
|
||||
# more_set_headers -t "application/json" "Cache-Control 'no-transform, no-store, no-cache, must-revalidate, proxy-revalidate, public, max-age=0'";
|
||||
# more_clear_headers -t "application/json" 'etag:*';
|
||||
|
||||
129
containers/conf/angie/snippets/security.conf-example
Executable file
129
containers/conf/angie/snippets/security.conf-example
Executable file
|
|
@ -0,0 +1,129 @@
|
|||
# Remove X-Powered-By, which is an information leak
|
||||
fastcgi_hide_header X-Powered-By;
|
||||
ignore_invalid_headers on;
|
||||
|
||||
location ~ /robots.txt { allow all; }
|
||||
location ~ /sitemap*xml { allow all; }
|
||||
|
||||
# Disallow scripts
|
||||
location ~* \.(pl|cgi|py|sh|lua)$ { return 404; }
|
||||
|
||||
# Skip .git, .htpasswd etc and all dirs starting with .
|
||||
location ~ (^|/)\. { return 404; }
|
||||
|
||||
#hide all dirs with synology diskstation stuff
|
||||
location ~ /DS_Store/ { return 404; }
|
||||
|
||||
# Help guard against SQL injection
|
||||
location ~* .(\;|'|\"|%22).*(request|insert|union|declare|drop)$ { return 404; }
|
||||
|
||||
#Disallow access to sensitive files
|
||||
location ~ /(\.|wp-config.php|readme.html|license.txt|nginx.conf|wp-config-sample.php|readme.txt|dbconfig.php) {
|
||||
deny all;
|
||||
}
|
||||
|
||||
location ~ ^/([^/])+\.(orig$|conf$|git$) { return 404; }
|
||||
location ~ /db.(conf|php|inc)|config.(xml|php|inc|ini)/ { return 404; }
|
||||
|
||||
# Disallow common hacks
|
||||
location ~* .(display_errors|set_time_limit|allow_url_include.*disable_functions.*open_basedir|set_magic_quotes_runtime|webconfig.txt.php|file_put_contentssever_root|wlwmanifest) {
|
||||
deny all;
|
||||
}
|
||||
|
||||
location ~* .(env|globals|encode|localhost|loopback|xmlrpc|revslider) {
|
||||
deny all;
|
||||
}
|
||||
|
||||
# Forbidden file extensions.
|
||||
# Guards against unintended exposure of development/configuration files.
|
||||
# stolen from modsecurity-crs
|
||||
|
||||
location ~ ^/([^/])+\.(asa$|asax$|ascx$|axd$|backup$|bak$|bat$|cdx$|cer$|cfg$|cmd$|com$|config$|conf$|cs$|csproj$|csr$|dat$|db$/.dbf$|dll$|dos$|htr$|htw$|ida$|idc|idq$|inc$|ini$|key|licx$|lnk$|log$|mdb$|old$|pass$|pdb$|pol$|printer$|pwd$|resources$|resx$|sql$|sys$|vb$|vbs$|vbproj$|vsdisco$|webinfo$|xsd$|xsx$) {
|
||||
return 404;
|
||||
}
|
||||
|
||||
# Hide /acme-challenge subdirectory and return 404 on all requests.
|
||||
# It is somewhat more secure than letting Nginx return 403.
|
||||
# Ending slash is important!
|
||||
location = /.well-known/acme-challenge/ {
|
||||
return 404;
|
||||
}
|
||||
|
||||
# Wordpress, remove any php handler
|
||||
location ~ ^/wp-content/uploads/([^/])+\.php { return 404; }
|
||||
location ~ ^/wp\-includes(/.*\.php(|[\/].*)|(|\/))$ { return 404; }
|
||||
location ~ ^/wp-content(/.*\.txt(|[\/].*)|(|\/))$ { return 404; }
|
||||
location ~ ^/wp-admin/(?:install|includes) { return 404; }
|
||||
location ~ ^/(?:readme|license)\. { return 404; }
|
||||
location ~ ^/wp-admin/(load\-styles|load\-scripts)\.php.*load\[\]\=([^&,]*,){20,} { return 404; }
|
||||
location ~ ^(/wp-json/wp/v[0-9]+/users) { return 404; }
|
||||
|
||||
#
|
||||
# MAGENTO 1
|
||||
#
|
||||
# Denied locations require a "^~" to prevent regexes (such as the PHP handler below) from matching
|
||||
# http://nginx.org/en/docs/http/ngx_http_core_module.html#location
|
||||
location /shell/ { deny all; }
|
||||
location /cgi-bin/ { deny all; }
|
||||
location /install.(php|txt) { deny all; }
|
||||
location /license.(php|txt) { deny all; }
|
||||
location ^~ /app/ { return 404; }
|
||||
location ^~ /includes/ { return 404; }
|
||||
location ^~ /media/downloadable/ { return 404; }
|
||||
location ^~ /pkginfo/ { return 404; }
|
||||
location ^~ /report/config.xml { return 404; }
|
||||
location ^~ /var/ { return 404; }
|
||||
location ^~ /lib/ { return 404; }
|
||||
location ^~ /dev/ { return 404; }
|
||||
location ^~ /RELEASE_NOTES.txt { return 404; }
|
||||
location ^~ /downloader/pearlib { return 404; }
|
||||
location ^~ /downloader/template { return 404; }
|
||||
location ^~ /downloader/Maged { return 404; }
|
||||
location ~* ^/errors/.+\.xml { return 404; }
|
||||
|
||||
location ~* /rss/order/new { return 403; }
|
||||
location ~* /rss/catalog/notifystock { return 403; }
|
||||
location ~* /rss/catalog/review { return 403; }
|
||||
|
||||
# Disallow PHP scripts in /media/ etc
|
||||
# Also render static 404 pages for missing media
|
||||
location ~ ^/(tmp|lib|media|shell|skin)/ {
|
||||
location ~ \.php$ {
|
||||
return 404;
|
||||
}
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
|
||||
# Don't skip .thumbs, this is a default directory where Magento places thumbnails
|
||||
# Nginx cannot "not" match something, instead the target is matched with an empty block
|
||||
# http://stackoverflow.com/a/16304073
|
||||
location ~ /\.thumbs { }
|
||||
|
||||
#location ~ /var/export {
|
||||
# satisfy all;
|
||||
# allow 1.2.3.4;
|
||||
# deny all;
|
||||
# auth_basic "Restricted";
|
||||
# auth_basic_user_file .htpasswd;
|
||||
# autoindex off;
|
||||
# }
|
||||
|
||||
|
||||
#taken from logfiles
|
||||
location ~* /(magento_version|util\/login.aspx|/install.php) { return 404; }
|
||||
|
||||
|
||||
#be carefull with ifs!!
|
||||
|
||||
#only allow the standard methods.
|
||||
if ($request_method !~ ^(GET|HEAD|POST)$ ) { return 404; }
|
||||
|
||||
# Note the .+ at the start: We want to allow url's like
|
||||
# order=create_date, which would otherwise match.
|
||||
#if ($arg_order ~* .+(select|create|insert|update|drop|delete|concat|alter|load)) { return 404; }
|
||||
|
||||
# CVE-2015-3428 / AW_Blog vulnerability
|
||||
# Note the .+ at the start: We want to allow url's like
|
||||
# order=create_date, which would otherwise match.
|
||||
#if ($arg_order ~* .+(select|create|insert|update|drop|delete|concat|alter|load)) { return 404; }
|
||||
|
||||
5
containers/conf/angie/snippets/snakeoil.conf
Executable file
5
containers/conf/angie/snippets/snakeoil.conf
Executable file
|
|
@ -0,0 +1,5 @@
|
|||
# Self signed certificates generated by the ssl-cert package
|
||||
# Don't use them in a production server!
|
||||
|
||||
ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
|
||||
ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
|
||||
124
containers/conf/angie/snippets/wordpress-example.conf
Executable file
124
containers/conf/angie/snippets/wordpress-example.conf
Executable file
|
|
@ -0,0 +1,124 @@
|
|||
#
|
||||
# A sample .conf file for enhancing wordpress security
|
||||
# Include this file in your wordpress vhost
|
||||
#
|
||||
|
||||
# httpblock: limit_req_zone $binary_remote_addr zone=WPRATELIMIT:10m rate=2r/s;
|
||||
location ~ \wp-login.php$ {
|
||||
limit_req zone=WPRATELIMIT;
|
||||
}
|
||||
|
||||
location = /favicon.ico {
|
||||
log_not_found off;
|
||||
access_log off;
|
||||
}
|
||||
|
||||
location = /robots.txt {
|
||||
allow all;
|
||||
# log_not_found off;
|
||||
# access_log off;
|
||||
}
|
||||
|
||||
location ~ /\. {
|
||||
deny all;
|
||||
}
|
||||
|
||||
#Deny access to wp-content folders for suspicious files
|
||||
location ~* ^/(wp-content)/(.*?)\.(zip|gz|tar|bzip2|7z|sql|bak|txt|orig|confbak|log|old|orig|original|php#|php~|php_bak|save|swo|swp)\$ {
|
||||
deny all;
|
||||
}
|
||||
|
||||
location ~ ^/wp-content/uploads/sucuri {
|
||||
deny all;
|
||||
}
|
||||
|
||||
location ~ ^/wp-content/updraft {
|
||||
deny all;
|
||||
}
|
||||
|
||||
# nginx block wpscann on plugins folder
|
||||
location ~* ^/wp-content/plugins/.+\.(txt|log|md)$ {
|
||||
deny all;
|
||||
error_page 403 =404 / ;
|
||||
}
|
||||
|
||||
# block access to install.php and upgrade.php
|
||||
location ^~ /wp-admin/install.php {
|
||||
deny all;
|
||||
error_page 403 =404 / ;
|
||||
}
|
||||
|
||||
location ^~ /wp-admin/upgrade.php {
|
||||
deny all;
|
||||
error_page 403 =404 / ;
|
||||
}
|
||||
|
||||
# Stop scann for the follow files on themes folder
|
||||
location ~* ^/wp-content/themes/.+\.(txt|log|md)$ {
|
||||
deny all;
|
||||
error_page 403 =404 / ;
|
||||
}
|
||||
|
||||
#Disable execution of scripts other than PHP from your document root
|
||||
location ~* .(pl|cgi|py|sh|lua|asp)$ {
|
||||
return 444;
|
||||
}
|
||||
|
||||
#Disable access to your configuration files and other files that you don’t want to users are able to see
|
||||
location ~* /(wp-config.php|readme.html|license.txt|nginx.conf) {
|
||||
deny all;
|
||||
}
|
||||
|
||||
# Disable wp-config.txt
|
||||
location = /wp-config.txt {
|
||||
deny all;
|
||||
access_log off;
|
||||
log_not_found off;
|
||||
}
|
||||
|
||||
location ~* /xmlrpc.php$ {
|
||||
allow 172.30.0.0/16;
|
||||
deny all;
|
||||
}
|
||||
|
||||
if ($request_method !~ ^(GET|POST|HEAD)$ ) {
|
||||
return 444;
|
||||
}
|
||||
|
||||
# Deny access to uploads that aren’t images, videos, music, etc.
|
||||
location ~* ^/wp-content/uploads/.*.(html|htm|shtml|php|js|swf)$ {
|
||||
deny all;
|
||||
}
|
||||
|
||||
location ~* /(?:uploads|files|wp-content|wp-includes|akismet)/.*.php$ {
|
||||
deny all;
|
||||
# access_log off;
|
||||
# log_not_found off;
|
||||
}
|
||||
|
||||
location ~ /\.(svn|git)/* {
|
||||
deny all;
|
||||
access_log off;
|
||||
log_not_found off;
|
||||
}
|
||||
location ~ /\.ht {
|
||||
deny all;
|
||||
access_log off;
|
||||
log_not_found off;
|
||||
}
|
||||
location ~ /\.user.ini {
|
||||
deny all;
|
||||
access_log off;
|
||||
log_not_found off;
|
||||
}
|
||||
|
||||
#location ~ ^/(?!(blog)/?) {
|
||||
# deny all;
|
||||
# access_log off;
|
||||
# log_not_found off;
|
||||
#}
|
||||
|
||||
# PLUGINS : Enable Rewrite Rules for Yoast SEO SiteMap
|
||||
# rewrite ^/sitemap_index\.xml$ /index.php?sitemap=1 last;
|
||||
# rewrite ^/([^/]+?)-sitemap([0-9]+)?\.xml$ /index.php?sitemap=$1&sitemap_n=$2 last;
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue