Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question is related to Drupal & nginx : a sound “general purpose” configuration?

I've successfully configured Nginx based on a number of examples I've found. Things are working fine, but I can't figure out what the following location directive is doing:

location ~ \..*/.*\.php$ {
  return 403;
}

What I think it does is to prevent .php files from being accessed, but in which cases I can't figure out?

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

If somebody requests a URL that ends with a pattern like .anything/anything.php then the Nginx returns a 403. Just for clarification, the regex only defines the ending of the url in this case, what's in front of the pattern doesn't matter.

Why? No idea. Maybe in the application you are using there is some kind of risk from these urls.

share|improve this answer
    
Thanks for your answer! –  sbrattla Feb 22 '13 at 6:40
add comment

It's not quite as simple as described. From the nginx pitfalls section:

Here, every request ending in .php will be passed to the FastCGI backend. The issue with this is that the default PHP configuration tries to guess which file you want to execute if the full path does not lead to an actual file on the filesystem.

For instance, if a request is made for /forum/avatar/1232.jpg/file.php which does not exist but if /forum/avatar/1232.jpg does, the PHP interpreter will process /forum/avatar/1232.jpg instead. If this contains embedded PHP code, this code will be executed accordingly.

So, this bit of code:

location ~* \.php$ {
  location ~ \..*/.*\.php$ {return 404;}
  ...
}

will capture this and return a Not Found response if attempted.

share|improve this answer
add comment

It looks like a naïve attempt to block access to a PHP file an attacker may have placed in a hidden directory (i.e. one that starts with a dot).

It blocks more than that (any directory that contains a dot) and doesn't prevent the attacker from accessing hidden PHP files.

If you are sure that this won't match any legitimate URIs, then there's no harm in leaving it there. On the other hand, there's no benefit either as any attacker who can place a PHP file in a hidden directory can place a PHP file in any other directory.

A better approach to security would be to prevent attackers from uploading PHP files at all and to use a file integrity system such as AIDE or OSSEC.

I could be wrong about the purpose of the location but the original author didn't describe the rule with a comment so it's difficult to be certain.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.