129 lines
5.3 KiB
Text
Executable file
129 lines
5.3 KiB
Text
Executable file
# Remove X-Powered-By, which is an information leak
|
|
fastcgi_hide_header X-Powered-By;
|
|
ignore_invalid_headers on;
|
|
|
|
location ~ /robots.txt { allow all; }
|
|
location ~ /sitemap*xml { allow all; }
|
|
|
|
# Disallow scripts
|
|
location ~* \.(pl|cgi|py|sh|lua)$ { return 404; }
|
|
|
|
# Skip .git, .htpasswd etc and all dirs starting with .
|
|
location ~ (^|/)\. { return 404; }
|
|
|
|
#hide all dirs with synology diskstation stuff
|
|
location ~ /DS_Store/ { return 404; }
|
|
|
|
# Help guard against SQL injection
|
|
location ~* .(\;|'|\"|%22).*(request|insert|union|declare|drop)$ { return 404; }
|
|
|
|
#Disallow access to sensitive files
|
|
location ~ /(\.|wp-config.php|readme.html|license.txt|nginx.conf|wp-config-sample.php|readme.txt|dbconfig.php) {
|
|
deny all;
|
|
}
|
|
|
|
location ~ ^/([^/])+\.(orig$|conf$|git$) { return 404; }
|
|
location ~ /db.(conf|php|inc)|config.(xml|php|inc|ini)/ { return 404; }
|
|
|
|
# Disallow common hacks
|
|
location ~* .(display_errors|set_time_limit|allow_url_include.*disable_functions.*open_basedir|set_magic_quotes_runtime|webconfig.txt.php|file_put_contentssever_root|wlwmanifest) {
|
|
deny all;
|
|
}
|
|
|
|
location ~* .(env|globals|encode|localhost|loopback|xmlrpc|revslider) {
|
|
deny all;
|
|
}
|
|
|
|
# Forbidden file extensions.
|
|
# Guards against unintended exposure of development/configuration files.
|
|
# stolen from modsecurity-crs
|
|
|
|
location ~ ^/([^/])+\.(asa$|asax$|ascx$|axd$|backup$|bak$|bat$|cdx$|cer$|cfg$|cmd$|com$|config$|conf$|cs$|csproj$|csr$|dat$|db$/.dbf$|dll$|dos$|htr$|htw$|ida$|idc|idq$|inc$|ini$|key|licx$|lnk$|log$|mdb$|old$|pass$|pdb$|pol$|printer$|pwd$|resources$|resx$|sql$|sys$|vb$|vbs$|vbproj$|vsdisco$|webinfo$|xsd$|xsx$) {
|
|
return 404;
|
|
}
|
|
|
|
# Hide /acme-challenge subdirectory and return 404 on all requests.
|
|
# It is somewhat more secure than letting Nginx return 403.
|
|
# Ending slash is important!
|
|
location = /.well-known/acme-challenge/ {
|
|
return 404;
|
|
}
|
|
|
|
# Wordpress, remove any php handler
|
|
location ~ ^/wp-content/uploads/([^/])+\.php { return 404; }
|
|
location ~ ^/wp\-includes(/.*\.php(|[\/].*)|(|\/))$ { return 404; }
|
|
location ~ ^/wp-content(/.*\.txt(|[\/].*)|(|\/))$ { return 404; }
|
|
location ~ ^/wp-admin/(?:install|includes) { return 404; }
|
|
location ~ ^/(?:readme|license)\. { return 404; }
|
|
location ~ ^/wp-admin/(load\-styles|load\-scripts)\.php.*load\[\]\=([^&,]*,){20,} { return 404; }
|
|
location ~ ^(/wp-json/wp/v[0-9]+/users) { return 404; }
|
|
|
|
#
|
|
# MAGENTO 1
|
|
#
|
|
# Denied locations require a "^~" to prevent regexes (such as the PHP handler below) from matching
|
|
# http://nginx.org/en/docs/http/ngx_http_core_module.html#location
|
|
location /shell/ { deny all; }
|
|
location /cgi-bin/ { deny all; }
|
|
location /install.(php|txt) { deny all; }
|
|
location /license.(php|txt) { deny all; }
|
|
location ^~ /app/ { return 404; }
|
|
location ^~ /includes/ { return 404; }
|
|
location ^~ /media/downloadable/ { return 404; }
|
|
location ^~ /pkginfo/ { return 404; }
|
|
location ^~ /report/config.xml { return 404; }
|
|
location ^~ /var/ { return 404; }
|
|
location ^~ /lib/ { return 404; }
|
|
location ^~ /dev/ { return 404; }
|
|
location ^~ /RELEASE_NOTES.txt { return 404; }
|
|
location ^~ /downloader/pearlib { return 404; }
|
|
location ^~ /downloader/template { return 404; }
|
|
location ^~ /downloader/Maged { return 404; }
|
|
location ~* ^/errors/.+\.xml { return 404; }
|
|
|
|
location ~* /rss/order/new { return 403; }
|
|
location ~* /rss/catalog/notifystock { return 403; }
|
|
location ~* /rss/catalog/review { return 403; }
|
|
|
|
# Disallow PHP scripts in /media/ etc
|
|
# Also render static 404 pages for missing media
|
|
location ~ ^/(tmp|lib|media|shell|skin)/ {
|
|
location ~ \.php$ {
|
|
return 404;
|
|
}
|
|
try_files $uri $uri/ =404;
|
|
}
|
|
|
|
# Don't skip .thumbs, this is a default directory where Magento places thumbnails
|
|
# Nginx cannot "not" match something, instead the target is matched with an empty block
|
|
# http://stackoverflow.com/a/16304073
|
|
location ~ /\.thumbs { }
|
|
|
|
#location ~ /var/export {
|
|
# satisfy all;
|
|
# allow 1.2.3.4;
|
|
# deny all;
|
|
# auth_basic "Restricted";
|
|
# auth_basic_user_file .htpasswd;
|
|
# autoindex off;
|
|
# }
|
|
|
|
|
|
#taken from logfiles
|
|
location ~* /(magento_version|util\/login.aspx|/install.php) { return 404; }
|
|
|
|
|
|
#be carefull with ifs!!
|
|
|
|
#only allow the standard methods.
|
|
if ($request_method !~ ^(GET|HEAD|POST)$ ) { return 404; }
|
|
|
|
# Note the .+ at the start: We want to allow url's like
|
|
# order=create_date, which would otherwise match.
|
|
#if ($arg_order ~* .+(select|create|insert|update|drop|delete|concat|alter|load)) { return 404; }
|
|
|
|
# CVE-2015-3428 / AW_Blog vulnerability
|
|
# Note the .+ at the start: We want to allow url's like
|
|
# order=create_date, which would otherwise match.
|
|
#if ($arg_order ~* .+(select|create|insert|update|drop|delete|concat|alter|load)) { return 404; }
|
|
|