Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.
Sign up to join this community
This question is related to Drupal & nginx : a sound “general purpose” configuration?
I've successfully configured Nginx based on a number of examples I've found. Things are working fine, but I can't figure out what the following location directive is doing:
location ~ \..*/.*\.php$ {
return 403;
}
What I think it does is to prevent .php files from being accessed, but in which cases I can't figure out?
If somebody requests a URL that ends with a pattern like .anything/anything.php then the Nginx returns a 403. Just for clarification, the regex only defines the ending of the url in this case, what's in front of the pattern doesn't matter.
Why? No idea. Maybe in the application you are using there is some kind of risk from these urls.
It's not quite as simple as described. From the nginx pitfalls section:
Here, every request ending in .php will be passed to the FastCGI backend. The issue with this is that the default PHP configuration tries to guess which file you want to execute if the full path does not lead to an actual file on the filesystem.
For instance, if a request is made for /forum/avatar/1232.jpg/file.php which does not exist but if /forum/avatar/1232.jpg does, the PHP interpreter will process /forum/avatar/1232.jpg instead. If this contains embedded PHP code, this code will be executed accordingly.
So, this bit of code:
location ~* \.php$ {
location ~ \..*/.*\.php$ {return 404;}
...
}
will capture this and return a Not Found response if attempted.
It looks like a naïve attempt to block access to a PHP file an attacker may have placed in a hidden directory (i.e. one that starts with a dot).
It blocks more than that (any directory that contains a dot) and doesn't prevent the attacker from accessing hidden PHP files.
If you are sure that this won't match any legitimate URIs, then there's no harm in leaving it there. On the other hand, there's no benefit either as any attacker who can place a PHP file in a hidden directory can place a PHP file in any other directory.
A better approach to security would be to prevent attackers from uploading PHP files at all and to use a file integrity system such as AIDE or OSSEC.
I could be wrong about the purpose of the location but the original author didn't describe the rule with a comment so it's difficult to be certain.
Shrikeh is correct:
location ~* \.php$ {
location ~ \..*/.*\.php$ {return 404;}
...
}
Is a way of filtering out mischevious urls like /forum/avatar/1232.jpg/file.php so that the default PHP configuration doesn't try and guess which file to execute if file.php is not available.
There are other ways of avoiding the same situation and https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/#passing-uncontrolled-requests-to-php discusses some.
