2025-11-04

This commit is contained in:
gcch 2025-11-04 13:21:41 +01:00
commit 66397de267
101 changed files with 2573 additions and 58 deletions

View file

@ -0,0 +1,723 @@
## Map user agent string
## Include this file in your serverblock
## Include bots.conf in your global config
map $http_user_agent $bad_client {
default 0;
01h4x.com 1;
360Spider 1;
404checker 1;
404enemy 1;
80legs 1;
ADmantX 1;
AIBOT 1;
ALittle\ 1;
Client 1;
ASPSeek 1;
Abonti 1;
Aboundex 1;
Aboundexbot 1;
Acunetix 1;
AdsTxtCrawlerTP 1;
AfD-Verbotsverfahren 1;
AhrefsBot 1;
AiHitBot 1;
Aipbot 1;
Alexibot 1;
AllSubmitter 1;
Alligator 1;
AlphaBot 1;
Anarchie 1;
Anarchy 1;
Anarchy99 1;
Ankit 1;
Anthill 1;
Apexoo 1;
Aspiegel 1;
Asterias 1;
Atomseobot 1;
Attach 1;
AwarioRssBot 1;
AwarioSmartBot 1;
BBBike 1;
BDCbot 1;
BDFetch 1;
BLEXBot 1;
BackDoorBot 1;
BackStreet 1;
BackWeb 1;
Backlink-Ceck 1;
BacklinkCrawler 1;
Badass 1;
Bandit 1;
Barkrowler 1;
BatchFTP 1;
Battleztar\ 1;
Bazinga 1;
BetaBot 1;
Bigfoot 1;
Bitacle 1;
BlackWidow 1;
Black\ 1;
Hole 1;
Blackboard 1;
Blow 1;
BlowFish 1;
Boardreader 1;
Bolt 1;
BotALot 1;
Brandprotect 1;
Brandwatch 1;
Buck 1;
Buddy 1;
BuiltBotTough 1;
BuiltWith 1;
Bullseye 1;
BunnySlippers 1;
BuzzSumo 1;
Bytespider 1;
CATExplorador 1;
CCBot 1;
CODE87 1;
CSHttp 1;
Calculon 1;
CazoodleBot 1;
Cegbfeieh 1;
CensysInspect 1;
CheTeam 1;
CheeseBot 1;
CherryPicker 1;
ChinaClaw 1;
Chlooe 1;
Citoid 1;
Claritybot 1;
Cliqzbot 1;
Cloud\ 1;
mapping 1;
Cocolyzebot 1;
Cogentbot 1;
Collector 1;
Copier 1;
CopyRightCheck 1;
Copyscape 1;
Cosmos 1;
Craftbot 1;
Crawling\ 1;
at\ 1;
Home\ 1;
Project 1;
CrazyWebCrawler 1;
Crescent 1;
CrunchBot 1;
Curious 1;
Custo 1;
CyotekWebCopy 1;
DBLBot 1;
DIIbot 1;
DSearch 1;
DTS\ 1;
Agent 1;
DataCha0s 1;
DatabaseDriverMysqli 1;
Demon 1;
Deusu 1;
Devil 1;
Digincore 1;
DigitalPebble 1;
Dirbuster 1;
Disco 1;
Discobot 1;
Discoverybot 1;
Dispatch 1;
DittoSpyder 1;
DnBCrawler-Analytics 1;
DnyzBot 1;
DomCopBot 1;
DomainAppender 1;
DomainCrawler 1;
DomainSigmaCrawler 1;
DomainStatsBot 1;
Domains\ 1;
Project 1;
Dotbot 1;
Download\ 1;
Wonder 1;
Dragonfly 1;
Drip 1;
ECCP/1.0 1;
EMail\ 1;
Siphon 1;
EMail\ 1;
Wolf 1;
EasyDL 1;
Ebingbong 1;
Ecxi 1;
EirGrabber 1;
EroCrawler 1;
Evil 1;
Exabot 1;
Express\ 1;
WebPictures 1;
ExtLinksBot 1;
Extractor 1;
ExtractorPro 1;
Extreme\ 1;
Picture\ 1;
Finder 1;
EyeNetIE 1;
Ezooms 1;
FDM 1;
FHscan 1;
FemtosearchBot 1;
Fimap 1;
Firefox/7.0 1;
FlashGet 1;
Flunky 1;
Foobot 1;
Freeuploader 1;
FrontPage 1;
Fuzz 1;
FyberSpider 1;
Fyrebot 1;
G-i-g-a-b-o-t 1;
GPTBot 1;
GT::WWW 1;
GalaxyBot 1;
Genieo 1;
GermCrawler 1;
GetRight 1;
GetWeb 1;
Getintent 1;
Gigabot 1;
Go!Zilla 1;
Go-Ahead-Got-It 1;
GoZilla 1;
Gotit 1;
GrabNet 1;
Grabber 1;
Grafula 1;
GrapeFX 1;
GrapeshotCrawler 1;
GridBot 1;
HEADMasterSEO 1;
HMView 1;
HTMLparser 1;
HTTP::Lite 1;
HTTrack 1;
Haansoft 1;
HaosouSpider 1;
Harvest 1;
Havij 1;
Heritrix 1;
Hloader 1;
HonoluluBot 1;
Humanlinks 1;
HybridBot 1;
IDBTE4M 1;
IDBot 1;
IRLbot 1;
Iblog 1;
Id-search 1;
IlseBot 1;
Image\ 1;
Fetch 1;
Image\ 1;
Sucker 1;
IndeedBot 1;
Indy\ 1;
Library 1;
InfoNaviRobot 1;
InfoTekies 1;
Intelliseek 1;
InterGET 1;
InternetSeer 1;
Internet\ 1;
Ninja 1;
Iria 1;
Iskanie 1;
IstellaBot 1;
JOC\ 1;
Web\ 1;
Spider 1;
JamesBOT 1;
Jbrofuzz 1;
JennyBot 1;
JetCar 1;
Jetty 1;
JikeSpider 1;
Joomla 1;
Jorgee 1;
JustView 1;
Jyxobot 1;
Kenjin\ 1;
Spider 1;
Keybot\ 1;
Translation-Search-Machine 1;
Keyword\ 1;
Density 1;
Kinza 1;
Kozmosbot 1;
LNSpiderguy 1;
LWP::Simple 1;
Lanshanbot 1;
Larbin 1;
Leap 1;
LeechFTP 1;
LeechGet 1;
LexiBot 1;
Lftp 1;
LibWeb 1;
Libwhisker 1;
LieBaoFast 1;
Lightspeedsystems 1;
Likse 1;
LinkScan 1;
LinkWalker 1;
Linkbot 1;
LinkextractorPro 1;
LinkpadBot 1;
LinksManager 1;
LinqiaMetadataDownloaderBot 1;
LinqiaRSSBot 1;
LinqiaScrapeBot 1;
Lipperhey 1;
Lipperhey\ 1;
Spider 1;
Litemage_walker 1;
Lmspider 1;
Ltx71 1;
MFC_Tear_Sample 1;
MIDown\ 1;
tool 1;
MIIxpc 1;
MJ12bot 1;
MQQBrowser 1;
MSFrontPage 1;
MSIECrawler 1;
MTRobot 1;
Mag-Net 1;
Magnet 1;
Mail.RU_Bot 1;
Majestic-SEO 1;
Majestic12 1;
Majestic\ 1;
SEO 1;
MarkMonitor 1;
MarkWatch 1;
Mass\ 1;
Downloader 1;
Masscan 1;
Mata\ 1;
Hari 1;
MauiBot 1;
Mb2345Browser 1;
MeanPath\ 1;
Bot 1;
Meanpathbot 1;
Mediatoolkitbot 1;
MegaIndex.ru 1;
Metauri 1;
MicroMessenger 1;
Microsoft\ 1;
Data\ 1;
Access 1;
Microsoft\ 1;
URL\ 1;
Control 1;
Minefield 1;
Mister\ 1;
PiX 1;
Moblie\ 1;
Safari 1;
Mojeek 1;
Mojolicious 1;
MolokaiBot 1;
Morfeus\ 1;
Fucking\ 1;
Scanner 1;
Mozlila 1;
Mr.4x3 1;
Msrabot 1;
Musobot 1;
NICErsPRO 1;
NPbot 1;
Name\ 1;
Intelligence 1;
Nameprotect 1;
Navroad 1;
NearSite 1;
Needle 1;
Nessus 1;
NetAnts 1;
NetLyzer 1;
NetMechanic 1;
NetSpider 1;
NetZIP 1;
Net\ 1;
Vampire 1;
Netcraft 1;
Nettrack 1;
Netvibes 1;
NextGenSearchBot 1;
Nibbler 1;
Niki-bot 1;
Nikto 1;
NimbleCrawler 1;
Nimbostratus 1;
Ninja 1;
Nmap 1;
Nuclei 1;
Nutch 1;
Octopus 1;
Offline\ 1;
Explorer 1;
Offline\ 1;
Navigator 1;
OnCrawl 1;
OpenLinkProfiler 1;
OpenVAS 1;
Openfind 1;
Openvas 1;
OrangeBot 1;
OrangeSpider 1;
OutclicksBot 1;
OutfoxBot 1;
PECL::HTTP 1;
PHPCrawl 1;
POE-Component-Client-HTTP 1;
PageAnalyzer 1;
PageGrabber 1;
PageScorer 1;
PageThing.com 1;
Page\ 1;
Analyzer 1;
Pandalytics 1;
Panscient 1;
Papa\ 1;
Foto 1;
Pavuk 1;
PeoplePal 1;
Petalbot 1;
Pi-Monster 1;
Picscout 1;
Picsearch 1;
PictureFinder 1;
Piepmatz 1;
Pimonster 1;
Pixray 1;
PleaseCrawl 1;
Pockey 1;
ProPowerBot 1;
ProWebWalker 1;
Probethenet 1;
Proximic 1;
Psbot 1;
Pu_iN 1;
Pump 1;
PxBroker 1;
PyCurl 1;
QueryN\ 1;
Metasearch 1;
Quick-Crawler 1;
RSSingBot 1;
Rainbot 1;
RankActive 1;
RankActiveLinkBot 1;
RankFlex 1;
RankingBot 1;
RankingBot2 1;
Rankivabot 1;
RankurBot 1;
Re-re 1;
ReGet 1;
RealDownload 1;
Reaper 1;
RebelMouse 1;
Recorder 1;
RedesScrapy 1;
RepoMonkey 1;
Ripper 1;
RocketCrawler 1;
Rogerbot 1;
SBIder 1;
SEOkicks 1;
SEOkicks-Robot 1;
SEOlyticsCrawler 1;
SEOprofiler 1;
SEOstats 1;
SISTRIX 1;
SMTBot 1;
SalesIntelligent 1;
ScanAlert 1;
Scanbot 1;
ScoutJet 1;
Scrapy 1;
Screaming 1;
ScreenerBot 1;
ScrepyBot 1;
Searchestate 1;
SearchmetricsBot 1;
Seekport 1;
SeekportBot 1;
SemanticJuice 1;
Semrush 1;
SemrushBot 1;
SentiBot 1;
SenutoBot 1;
SeoSiteCheckup 1;
SeobilityBot 1;
Seomoz 1;
Shodan 1;
Siphon 1;
SiteCheckerBotCrawler 1;
SiteExplorer 1;
SiteLockSpider 1;
SiteSnagger 1;
SiteSucker 1;
Site\ 1;
Sucker 1;
Sitebeam 1;
Siteimprove 1;
Sitevigil 1;
SlySearch 1;
SmartDownload 1;
Snake 1;
Snapbot 1;
Snoopy 1;
SocialRankIOBot 1;
Sociscraper 1;
Sogou\ 1;
web\ 1;
spider 1;
Sosospider 1;
Sottopop 1;
SpaceBison 1;
Spammen 1;
SpankBot 1;
Spanner 1;
Spbot 1;
Spinn3r 1;
SputnikBot 1;
Sqlmap 1;
Sqlworm 1;
Sqworm 1;
Steeler 1;
Stripper 1;
Sucker 1;
Sucuri 1;
SuperBot 1;
SuperHTTP 1;
Surfbot 1;
SurveyBot 1;
Suzuran 1;
Swiftbot 1;
Szukacz 1;
T0PHackTeam 1;
T8Abot 1;
Teleport 1;
TeleportPro 1;
Telesoft 1;
Telesphoreo 1;
Telesphorep 1;
TheNomad 1;
The\ 1;
Intraformant 1;
Thumbor 1;
TightTwatBot 1;
TinyTestBot 1;
Titan 1;
Toata 1;
Toweyabot 1;
Tracemyfile 1;
Trendiction 1;
Trendictionbot 1;
True_Robot 1;
Turingos 1;
Turnitin 1;
TurnitinBot 1;
TwengaBot 1;
Twice 1;
Typhoeus 1;
URLy.Warning 1;
URLy\ 1;
Warning 1;
UnisterBot 1;
Upflow 1;
V-BOT 1;
VB\ 1;
Project 1;
VCI 1;
Vacuum 1;
Vagabondo 1;
VelenPublicWebCrawler 1;
VeriCiteCrawler 1;
VidibleScraper 1;
Virusdie 1;
VoidEYE 1;
Voil 1;
Voltron 1;
WASALive-Bot 1;
WBSearchBot 1;
WEBDAV 1;
WISENutbot 1;
WPScan 1;
WWW-Collector-E 1;
WWW-Mechanize 1;
WWW::Mechanize 1;
WWWOFFLE 1;
Wallpapers 1;
Wallpapers/3.0 1;
WallpapersHD 1;
WeSEE 1;
WebAuto 1;
WebBandit 1;
WebCollage 1;
WebCopier 1;
WebEnhancer 1;
WebFetch 1;
WebFuck 1;
WebGo\ 1;
IS 1;
WebImageCollector 1;
WebLeacher 1;
WebPix 1;
WebReaper 1;
WebSauger 1;
WebStripper 1;
WebSucker 1;
WebWhacker 1;
WebZIP 1;
Web\ 1;
Auto 1;
Web\ 1;
Collage 1;
Web\ 1;
Enhancer 1;
Web\ 1;
Fetch 1;
Web\ 1;
Fuck 1;
Web\ 1;
Pix 1;
Web\ 1;
Sauger 1;
Web\ 1;
Sucker 1;
Webalta 1;
WebmasterWorldForumBot 1;
Webshag 1;
WebsiteExtractor 1;
WebsiteQuester 1;
Website\ 1;
Quester 1;
Webster 1;
Whack 1;
Whacker 1;
Whatweb 1;
Who.is\ 1;
Bot 1;
Widow 1;
WinHTTrack 1;
WiseGuys\ 1;
Robot 1;
Wonderbot 1;
Woobot 1;
Wotbox 1;
Wprecon 1;
Xaldon\ 1;
WebSpider 1;
Xaldon_WebSpider 1;
Xenu 1;
YoudaoBot 1;
Zade 1;
Zauba 1;
Zermelo 1;
Zeus 1;
Zitebot 1;
ZmEu 1;
ZoomBot 1;
ZoominfoBot 1;
ZumBot 1;
ZyBorg 1;
adscanner 1;
archive.org_bot 1;
arquivo-web-crawler 1;
arquivo.pt 1;
autoemailspider 1;
backlink-check 1;
cah.io.community 1;
check1.exe 1;
clark-crawler 1;
coccocbot 1;
cognitiveseo 1;
com.plumanalytics 1;
crawl.sogou.com 1;
crawler.feedback 1;
crawler4j 1;
dataforseo.com 1;
dataforseobot 1;
demandbase-bot 1;
domainsproject.org 1;
eCatch 1;
evc-batch 1;
facebookscraper 1;
gopher 1;
heritrix 1;
instabid 1;
internetVista\ 1;
monitor 1;
ips-agent 1;
isitwp.com 1;
iubenda-radar 1;
linkdexbot 1;
lwp-request 1;
lwp-trivial 1;
magpie-crawler 1;
meanpathbot 1;
mediawords 1;
muhstik-scan 1;
netEstate\ 1;
NE\ 1;
Crawler 1;
oBot 1;
openai 1;
openai.com 1;
page\ 1;
scorer 1;
pcBrowser 1;
plumanalytics 1;
polaris\ 1;
version 1;
probe-image-size 1;
ripz 1;
s1z.ru 1;
satoristudio.net 1;
scalaj-http 1;
scan.lol 1;
seobility 1;
seocompany.store 1;
seoscanners 1;
seostar 1;
serpstatbot 1;
sexsearcher 1;
sitechecker.pro 1;
siteripz 1;
sogouspider 1;
sp_auditbot 1;
spyfu 1;
sysscan 1;
tAkeOut 1;
trendiction.com 1;
trendiction.de 1;
ubermetrics-technologies.com 1;
voyagerx.com 1;
webgains-bot 1;
webmeup-crawler 1;
webpros.com 1;
webprosbot 1;
x09Mozilla 1;
x22Mozilla 1;
xpymep1.exe 1;
zauba.io 1;
zgrab 1;
}

View file

@ -0,0 +1,20 @@
# Use this with maps.conf in nginx.conf
# include this in your vhost/location
# Return Code 410 is special, it says the content is deleted, indexers *should* their content.
#see maps.conf
if ($bad_client) { return 410; }
# Tailored for Magento 1 and layered navigation
## Dont let search bots to drill your website | exclude some args from indexing
#if ($args ~ ^(brand|cat|color|dir|from|limit|price|type|mode|size|manufacturer)=.+) { set $filters A; }
#if ($http_user_agent ~* "http|bot|crawl|spider|Google|bing|Yahoo|Yandex") { set $filters "${filters}B"; }
#if ($filters = AB) { return 410; }
#uncomment this if you don't want to be indexed by google/yahoo/yandex/bing etc
#if ($http_user_agent ~* "Bot|Google|Bing|Yahoo|Yandex") {
# return 410;
#}

View file

@ -0,0 +1,26 @@
# Include this file in your vhost
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 104.16.0.0/13;
set_real_ip_from 104.24.0.0/14;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 131.0.72.0/22;
set_real_ip_from 2400:cb00::/32;
set_real_ip_from 2606:4700::/32;
set_real_ip_from 2803:f800::/32;
set_real_ip_from 2405:b500::/32;
set_real_ip_from 2405:8100::/32;
set_real_ip_from 2a06:98c0::/29;
set_real_ip_from 2c0f:f248::/32;
real_ip_header CF-Connecting-IP;

View file

@ -0,0 +1,13 @@
# regex to split $uri to $fastcgi_script_name and $fastcgi_path
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
# Check that the PHP script exists before passing it
try_files $fastcgi_script_name =404;
# Bypass the fact that try_files resets $fastcgi_path_info
# see: http://trac.nginx.org/nginx/ticket/321
set $path_info $fastcgi_path_info;
fastcgi_param PATH_INFO $path_info;
fastcgi_index index.php;
include fastcgi.conf;

View file

@ -0,0 +1,14 @@
So, you want http3?
This is a quick & dirty howto.
1. Open port 443/udp to your nginx instance
2. Put http3 on; in nginx.conf. (and additional http2 on; but not required)
3. Add Listen 443 quic; to your ssl interface
4. Put the following in your serverblock (in location /) add_header Alt-Svc 'h3=":443"'; # Advertise that HTTP/3 is available
5. Check with nginx -t if everything is alright
6. Restart nginx
7. Check with curl or an online http3 checker
Please note, the nginx from http://deb.myguard.nl is compiled with OpenSSL3.0.x+quic, you should install the custom OpenSSL from deb.myguard.nl as well if not done automaticly.

View file

@ -0,0 +1,48 @@
#############################################################################
# Configuration file for Let's Encrypt ACME Challenge location
# This file is already included in listen_xxx.conf files.
# Do NOT include it separately!
#############################################################################
#
# This config enables to access /.well-known/acme-challenge/xxxxxxxxxxx
# on all our sites (HTTP), including all subdomains.
# This is required by ACME Challenge (webroot authentication).
# You can check that this location is working by placing ping.txt here:
# /var/www/letsencrypt/.well-known/acme-challenge/ping.txt
# And pointing your browser to:
# http://xxx.domain.tld/.well-known/acme-challenge/ping.txt
#
# Sources:
# https://community.letsencrypt.org/t/howto-easy-cert-generation-and-renewal-with-nginx/3491
#
#############################################################################
# Rule for legitimate ACME Challenge requests (like /.well-known/acme-challenge/xxxxxxxxx)
# We use ^~ here, so that we don't check other regexes (for speed-up). We actually MUST cancel
# other regex checks, because in our other config files have regex rule that denies access to files with dotted names.
location ^~ /.well-known/acme-challenge/ {
allow all;
auth_basic off;
# Set correct content type. According to this:
# https://community.letsencrypt.org/t/using-the-webroot-domain-verification-method/1445/29
# Current specification requires "text/plain" or no content header at all.
# It seems that "text/plain" is a safe option.
default_type "text/plain";
# This directory must be the same as in /etc/letsencrypt/cli.ini
# as "webroot-path" parameter. Also don't forget to set "authenticator" parameter
# there to "webroot".
# Do NOT use alias, use root! Target directory is located here:
# /var/www/common/letsencrypt/.well-known/acme-challenge/
root /var/www/html;
}
# Hide /acme-challenge subdirectory and return 404 on all requests.
# It is somewhat more secure than letting Nginx return 403.
# Ending slash is important!
# location = /.well-known/acme-challenge/ {
# return 404;
# }

View file

@ -0,0 +1,91 @@
modsecurity on;
modsecurity_rules '
SecRuleEngine On
#SecDebugLog /tmp/modsec_debug.log
#SecDebugLogLevel 9
#SecRuleRemoveById 10
#SecDataDir /var/cache/modsecurity
';
modsecurity_rules_file /etc/modsecurity/modsecurity.conf;
modsecurity_rules_file /etc/modsecurity/ownrules.conf;
#CRS
#modsecurity_rules_file /etc/modsecurity/crs/crs-setup.conf;
#modsecurity_rules_file /etc/modsecurity/crs/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-901-INITIALIZATION.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-903.9003-NEXTCLOUD-EXCLUSION-RULES.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-903.9004-DOKUWIKI-EXCLUSION-RULES.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-903.9005-CPANEL-EXCLUSION-RULES.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-905-COMMON-EXCEPTIONS.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-910-IP-REPUTATION.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-911-METHOD-ENFORCEMENT.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-912-DOS-PROTECTION.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-913-SCANNER-DETECTION.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-920-PROTOCOL-ENFORCEMENT.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-921-PROTOCOL-ATTACK.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-930-APPLICATION-ATTACK-LFI.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-931-APPLICATION-ATTACK-RFI.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-932-APPLICATION-ATTACK-RCE.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-933-APPLICATION-ATTACK-PHP.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-941-APPLICATION-ATTACK-XSS.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-942-APPLICATION-ATTACK-SQLI.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-944-APPLICATION-ATTACK-JAVA.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/REQUEST-949-BLOCKING-EVALUATION.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/RESPONSE-950-DATA-LEAKAGES.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/RESPONSE-951-DATA-LEAKAGES-SQL.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/RESPONSE-952-DATA-LEAKAGES-JAVA.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/RESPONSE-953-DATA-LEAKAGES-PHP.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/RESPONSE-954-DATA-LEAKAGES-IIS.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/RESPONSE-959-BLOCKING-EVALUATION.conf;
#modsecurity_rules_file /usr/share/modsecurity-crs/RESPONSE-980-CORRELATION.conf;
#modsecurity_rules_file /etc/modsecurity/crs/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf;
#
##https://waf.comodo.com/
#
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/00_Init_Initialization.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/01_Init_AppsInitialization.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/02_Global_Generic.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/03_Global_Agents.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/04_Global_Domains.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/05_Global_Incoming.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/06_Global_Backdoor.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/07_XSS_XSS.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/08_Global_Other.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/09_Bruteforce_Bruteforce.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/10_HTTP_HTTP.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/11_HTTP_HTTPDoS.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/12_HTTP_Protocol.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/13_HTTP_Request.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/14_Outgoing_FilterGen.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/15_Outgoing_FilterASP.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/16_Outgoing_FilterPHP.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/17_Outgoing_FilterSQL.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/18_Outgoing_FilterOther.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/19_Outgoing_FilterInFrame.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/20_Outgoing_FiltersEnd.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/21_PHP_PHPGen.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/22_SQL_SQLi.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/23_ROR_RORGen.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/24_Apps_Joomla.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/25_Apps_JComponent.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/26_Apps_WordPress.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/27_Apps_WPPlugin.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/28_Apps_WHMCS.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/29_Apps_Drupal.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/30_Apps_OtherApps.conf;
#modsecurity_rules_file /etc/modsecurity/cwaf/rules/categories.conf;
#https://github.com/Rev3rseSecurity/wordpress-modsecurity-ruleset
#modsecurity_rules_file /etc/modsecurity/wordpress-modsecurity-ruleset/01-SETUP.conf;
#modsecurity_rules_file /etc/modsecurity/wordpress-modsecurity-ruleset/02-INITIALIZATION.conf;
#modsecurity_rules_file /etc/modsecurity/wordpress-modsecurity-ruleset/03-BRUTEFORCE.conf;
#modsecurity_rules_file /etc/modsecurity/wordpress-modsecurity-ruleset/04-EVENTS.conf;
#modsecurity_rules_file /etc/modsecurity/wordpress-modsecurity-ruleset/05-HARDENING.conf;

View file

@ -0,0 +1,10 @@
# When using openresty's lua, you have to include this in your http {} block
lua_package_path "/usr/share/lua/5.1/?.lua;;";
init_by_lua_block {
require "resty.core"
collectgarbage("collect") -- just to collect any garbage
}

View file

@ -0,0 +1,3 @@
see https://github.com/vozlt/nginx-module-vts/
If you want to contribute a sane config, please submit it

View file

@ -0,0 +1,35 @@
#include this in the location of your vhost you want to proxy
proxy_set_header Host $host;
proxy_set_header Scheme $scheme;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header REMOTE_ADDR $remote_addr;
proxy_set_header HTTP_CF_CONNECTING_IP $remote_addr;
proxy_set_header Early-Data $ssl_early_data;
add_header Front-End-Https on;
proxy_redirect off;
proxy_buffering off;
proxy_buffer_size 128k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 256k;
proxy_ssl_verify off;
proxy_ssl_session_reuse on;
proxy_ssl_protocols TLSv1.3 TLSv1.2;
# WebSocket stuff
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
# Prevent application/json content from being cached (Breaks nzbget and possibly others)
# more_set_headers -t "application/json" "Last-Modified $date_gmt";
# more_set_headers -t "application/json" "Expect-CT 'max-age=0; enforce'";
# more_set_headers -t "application/json" "Cache-Control 'no-transform, no-store, no-cache, must-revalidate, proxy-revalidate, public, max-age=0'";
# more_clear_headers -t "application/json" 'etag:*';

View file

@ -0,0 +1,129 @@
# Remove X-Powered-By, which is an information leak
fastcgi_hide_header X-Powered-By;
ignore_invalid_headers on;
location ~ /robots.txt { allow all; }
location ~ /sitemap*xml { allow all; }
# Disallow scripts
location ~* \.(pl|cgi|py|sh|lua)$ { return 404; }
# Skip .git, .htpasswd etc and all dirs starting with .
location ~ (^|/)\. { return 404; }
#hide all dirs with synology diskstation stuff
location ~ /DS_Store/ { return 404; }
# Help guard against SQL injection
location ~* .(\;|'|\"|%22).*(request|insert|union|declare|drop)$ { return 404; }
#Disallow access to sensitive files
location ~ /(\.|wp-config.php|readme.html|license.txt|nginx.conf|wp-config-sample.php|readme.txt|dbconfig.php) {
deny all;
}
location ~ ^/([^/])+\.(orig$|conf$|git$) { return 404; }
location ~ /db.(conf|php|inc)|config.(xml|php|inc|ini)/ { return 404; }
# Disallow common hacks
location ~* .(display_errors|set_time_limit|allow_url_include.*disable_functions.*open_basedir|set_magic_quotes_runtime|webconfig.txt.php|file_put_contentssever_root|wlwmanifest) {
deny all;
}
location ~* .(env|globals|encode|localhost|loopback|xmlrpc|revslider) {
deny all;
}
# Forbidden file extensions.
# Guards against unintended exposure of development/configuration files.
# stolen from modsecurity-crs
location ~ ^/([^/])+\.(asa$|asax$|ascx$|axd$|backup$|bak$|bat$|cdx$|cer$|cfg$|cmd$|com$|config$|conf$|cs$|csproj$|csr$|dat$|db$/.dbf$|dll$|dos$|htr$|htw$|ida$|idc|idq$|inc$|ini$|key|licx$|lnk$|log$|mdb$|old$|pass$|pdb$|pol$|printer$|pwd$|resources$|resx$|sql$|sys$|vb$|vbs$|vbproj$|vsdisco$|webinfo$|xsd$|xsx$) {
return 404;
}
# Hide /acme-challenge subdirectory and return 404 on all requests.
# It is somewhat more secure than letting Nginx return 403.
# Ending slash is important!
location = /.well-known/acme-challenge/ {
return 404;
}
# Wordpress, remove any php handler
location ~ ^/wp-content/uploads/([^/])+\.php { return 404; }
location ~ ^/wp\-includes(/.*\.php(|[\/].*)|(|\/))$ { return 404; }
location ~ ^/wp-content(/.*\.txt(|[\/].*)|(|\/))$ { return 404; }
location ~ ^/wp-admin/(?:install|includes) { return 404; }
location ~ ^/(?:readme|license)\. { return 404; }
location ~ ^/wp-admin/(load\-styles|load\-scripts)\.php.*load\[\]\=([^&,]*,){20,} { return 404; }
location ~ ^(/wp-json/wp/v[0-9]+/users) { return 404; }
#
# MAGENTO 1
#
# Denied locations require a "^~" to prevent regexes (such as the PHP handler below) from matching
# http://nginx.org/en/docs/http/ngx_http_core_module.html#location
location /shell/ { deny all; }
location /cgi-bin/ { deny all; }
location /install.(php|txt) { deny all; }
location /license.(php|txt) { deny all; }
location ^~ /app/ { return 404; }
location ^~ /includes/ { return 404; }
location ^~ /media/downloadable/ { return 404; }
location ^~ /pkginfo/ { return 404; }
location ^~ /report/config.xml { return 404; }
location ^~ /var/ { return 404; }
location ^~ /lib/ { return 404; }
location ^~ /dev/ { return 404; }
location ^~ /RELEASE_NOTES.txt { return 404; }
location ^~ /downloader/pearlib { return 404; }
location ^~ /downloader/template { return 404; }
location ^~ /downloader/Maged { return 404; }
location ~* ^/errors/.+\.xml { return 404; }
location ~* /rss/order/new { return 403; }
location ~* /rss/catalog/notifystock { return 403; }
location ~* /rss/catalog/review { return 403; }
# Disallow PHP scripts in /media/ etc
# Also render static 404 pages for missing media
location ~ ^/(tmp|lib|media|shell|skin)/ {
location ~ \.php$ {
return 404;
}
try_files $uri $uri/ =404;
}
# Don't skip .thumbs, this is a default directory where Magento places thumbnails
# Nginx cannot "not" match something, instead the target is matched with an empty block
# http://stackoverflow.com/a/16304073
location ~ /\.thumbs { }
#location ~ /var/export {
# satisfy all;
# allow 1.2.3.4;
# deny all;
# auth_basic "Restricted";
# auth_basic_user_file .htpasswd;
# autoindex off;
# }
#taken from logfiles
location ~* /(magento_version|util\/login.aspx|/install.php) { return 404; }
#be carefull with ifs!!
#only allow the standard methods.
if ($request_method !~ ^(GET|HEAD|POST)$ ) { return 404; }
# Note the .+ at the start: We want to allow url's like
# order=create_date, which would otherwise match.
#if ($arg_order ~* .+(select|create|insert|update|drop|delete|concat|alter|load)) { return 404; }
# CVE-2015-3428 / AW_Blog vulnerability
# Note the .+ at the start: We want to allow url's like
# order=create_date, which would otherwise match.
#if ($arg_order ~* .+(select|create|insert|update|drop|delete|concat|alter|load)) { return 404; }

View file

@ -0,0 +1,5 @@
# Self signed certificates generated by the ssl-cert package
# Don't use them in a production server!
ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;

View file

@ -0,0 +1,124 @@
#
# A sample .conf file for enhancing wordpress security
# Include this file in your wordpress vhost
#
# httpblock: limit_req_zone $binary_remote_addr zone=WPRATELIMIT:10m rate=2r/s;
location ~ \wp-login.php$ {
limit_req zone=WPRATELIMIT;
}
location = /favicon.ico {
log_not_found off;
access_log off;
}
location = /robots.txt {
allow all;
# log_not_found off;
# access_log off;
}
location ~ /\. {
deny all;
}
#Deny access to wp-content folders for suspicious files
location ~* ^/(wp-content)/(.*?)\.(zip|gz|tar|bzip2|7z|sql|bak|txt|orig|confbak|log|old|orig|original|php#|php~|php_bak|save|swo|swp)\$ {
deny all;
}
location ~ ^/wp-content/uploads/sucuri {
deny all;
}
location ~ ^/wp-content/updraft {
deny all;
}
# nginx block wpscann on plugins folder
location ~* ^/wp-content/plugins/.+\.(txt|log|md)$ {
deny all;
error_page 403 =404 / ;
}
# block access to install.php and upgrade.php
location ^~ /wp-admin/install.php {
deny all;
error_page 403 =404 / ;
}
location ^~ /wp-admin/upgrade.php {
deny all;
error_page 403 =404 / ;
}
# Stop scann for the follow files on themes folder
location ~* ^/wp-content/themes/.+\.(txt|log|md)$ {
deny all;
error_page 403 =404 / ;
}
#Disable execution of scripts other than PHP from your document root
location ~* .(pl|cgi|py|sh|lua|asp)$ {
return 444;
}
#Disable access to your configuration files and other files that you dont want to users are able to see
location ~* /(wp-config.php|readme.html|license.txt|nginx.conf) {
deny all;
}
# Disable wp-config.txt
location = /wp-config.txt {
deny all;
access_log off;
log_not_found off;
}
location ~* /xmlrpc.php$ {
allow 172.30.0.0/16;
deny all;
}
if ($request_method !~ ^(GET|POST|HEAD)$ ) {
return 444;
}
# Deny access to uploads that arent images, videos, music, etc.
location ~* ^/wp-content/uploads/.*.(html|htm|shtml|php|js|swf)$ {
deny all;
}
location ~* /(?:uploads|files|wp-content|wp-includes|akismet)/.*.php$ {
deny all;
# access_log off;
# log_not_found off;
}
location ~ /\.(svn|git)/* {
deny all;
access_log off;
log_not_found off;
}
location ~ /\.ht {
deny all;
access_log off;
log_not_found off;
}
location ~ /\.user.ini {
deny all;
access_log off;
log_not_found off;
}
#location ~ ^/(?!(blog)/?) {
# deny all;
# access_log off;
# log_not_found off;
#}
# PLUGINS : Enable Rewrite Rules for Yoast SEO SiteMap
# rewrite ^/sitemap_index\.xml$ /index.php?sitemap=1 last;
# rewrite ^/([^/]+?)-sitemap([0-9]+)?\.xml$ /index.php?sitemap=$1&sitemap_n=$2 last;