Can anyone explain the reason of adding the following lines, in Nginx config, when used with php-fpm
location ~ \..*/.*\.php$ {
return 403;
}
Thanks.
You'd better read about the regular expression in order to understand this. The above config means that a request begin with a dot, followed by any characters, then slash, and end with something.php will be forbidden, for eg:
http://domain.com/.abc/def.php
$ telnet localhost 81
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
GET /.abc/def.php HTTP/1.0
HTTP/1.1 403 Forbidden
Server: nginx/1.0.5
Date: Wed, 19 Oct 2011 15:09:58 GMT
Content-Type: text/html
Content-Length: 168
Connection: close
There are some long threads about cgi.fix_pathinfo = 1
and why it is a security problem on the nginx boards, in a few words without that rule in default setups one can masquerade a non php file(like a .jpg
) as a php one and trick the server into processing the code in the malicious file.
Drupal, Wordpress, Squirrel etc pass their parameters to scripts through queries like /index.php?q=user/login
[or user:login]. It's usually hidden in the url (cleaning/masking) yet thats how it works.
If you're using CGI to pass the request to a backend, you need to pass it in a parameter called PATH_INFO. The php developers have included a feature (stupidly enabled by default) that makes use of this.
This leads to a security problem with most common Nginx setups. Someone uploads a malicious php file to your server, say with a jpg extension. Then they go to http://server.com/sites/server.com/files/mybadfile.jpg/whatever.php
Because it ends in .php
common nginx configs just pass it to the php backend as SOMESCRIPT whatever.php
. Due to cgi.fix_pathinfo = 1
, PHP then "fixes" the request by changing that to be
SOMESCRIPT mybadfile.jpg
and PATH_INFO /whatever.php
and executes mybadfile.jpg
as a php script.
You can imagine the rest.
what the regular expression means is that any direct request to any file in any subdirectory is to be forbidden [return 403] if the file ends with .php
[the .php$ part with $ showing the end of the line, whatever ends with that]
to understand that or regular expressions in general you should probably search the nginx documentation or regular expressions in general
See here: http://forum.nginx.org/read.php?2,88845,88996
Long story short, in some setups, someone could upload a malicious file (JPG, whatever) and get it processed by PHP.