8

I am trying to set up Nginx so that all connections to my numeric ip are denied, with the exception of a few arbitrary directories and files. So if someone goes to my IP, they are allowed to access the index.php file, and the phpmyadmin directory for example, but should they try to access any other directories, they will be denied.

This is my server block from nginx.conf:

server {
        listen       80;
        server_name  localhost;

        location / {
            root   html;
            index  index.html index.htm index.php;
        }

        location ~ \.php$ {
            root           html;
            fastcgi_pass   unix:/var/run/php-fpm/php-fpm.sock;
            fastcgi_index  index.php;
            fastcgi_param  SCRIPT_FILENAME /srv/http/nginx/$fastcgi_script_name;
            include        fastcgi_params;
        }
}

How would I proceed? Thanks very much!

4 Answers 4

13

The easiest path would be to start out by denying all access, then only granting access to those directories you want. As ring0 pointed out, you can use the default (default_server in 0.8) flag on the listen directive. However, if you already have a server you want to use as a default for unknown named access to your host, you can also just catch requests without a host header or with your server's ip address with something like this (replacing 1.2.3.4 with your server's ip:

upstream _php {
  server unix:/var/run/php-fpm/php-fpm.sock;
}

server {
  server_name "" 1.2.3.4;

  root /path/to/root;
  index index.php;

  include fastcgi_params;
  fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

  # deny everything that doesn't match another location
  location / { deny all; }

  # allow loading /index.php
  location = / { } # need to allow GET / to internally redirect to /index.php
  location = /index.php { fastcgi_pass _php; }

  # allow access to phpmyadmin
  location /phpmyadmin/ { } # Allow access to static files in /phpmyadmin/
  location ~ ^/phpmyadmin/.*\.php$ { fastcgi_pass _php; } # phpmyadmin php files
}

the fastcgi_params will be inherited by both locations that fastcgi_pass, and only /index.php and /phpmyadmin/ are allowed. I've also added an upstream block for php, which makes it easier should you ever need to add to or change it in the future.

1
  • Thanks for the awesome answer kolbyjack, worked very well. Sorry it took so long to put you down as correct, had to find the time to work on this again.
    – Ben
    Jan 25, 2011 at 22:47
4

Creative use of the location and deny rules negated in regex, something like:

    location / {
        root   html;
        index  index.html index.htm index.php;
    }

    location ~* !^/(index.(php|html|htm)$)|(phpmyadmin/) {
        deny all;
    }

    location ~ \.php$ {
        root           html;
        fastcgi_pass   unix:/var/run/php-fpm/php-fpm.sock;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME /srv/http/nginx/$fastcgi_script_name;
        include        fastcgi_params;
    }

That's untested but you get the idea.

http://wiki.nginx.org/HttpAccessModule

http://wiki.nginx.org/HttpCoreModule#location

Also, this may help you write it:

http://www.regextester.com/

2

It is easier to declare servers that are called with a domain name, and declare a default server that will include direct-IP accesses.

For instance your domain configuration could be used for, say, mydomain.com

server {
        listen       80;
        server_name  mydomain.com *.mydomain.com;
        root /var/www/html/mydomain.com
        ...

Having your regular files in the directory /var/www/html/mydomain.com.

And the default entry would only allow access to some specific files in a different location.
Note the default keyword after the listen 80.

server {
        listen       80 default;
        server_name  _ *;
        root /var/www/html/restricted
        ...

And you put the default files in /var/www/html/restricted, that will be served for localhost and raw IP addresses.

0

You can setting directly all path to the index.php and setting only on this file fastcgi php7 for nginx

    //redirect all to index.php
    location / {
        autoindex off;
        set $redirect_url $uri;
        try_files $uri $uri/ /index.php$is_args$query_string;
    }

    location = /index.php {
        include fastcgi.conf;
        fastcgi_pass unix:/run/php/php7.0-fpm.sock;

        //Extra Params script PHP
        fastcgi_param PATH_INFO $redirect_url;
        fastcgi_param HTTP_HOST $server_name;
    }
1
  • 1
    please add come comments it's completely unclear what this does
    – blkpingu
    Mar 14, 2021 at 14:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .