PHP文件下載，如果Nginx的拒絕規則啓用

Question

我已經有一年多了，沒有問題，運行Nginx上的服務器，它提供HTML和PHP文件只是罰款就可以了WordPress網站。最近有在WP-login.php中的一些暴力攻擊，所以我決定通過IP使用Nginx的的拒絕所有規則來限制進入這些領域。

我實現下面的規則和IP的不在列表中獲得403如預期，但允許IP地址爲住客提供下載WP-的login.php文件，而不是該網站的頁面。

這裏是域規則：

server { 
    listen  10.99.0.20:8080; 
    server_name www.example.com; 
    root /home/www.example.com/public_html; 
    index index.html index.htm index.php; 
    include conf.d/whitelisted.conf; 
    include conf.d/wp/restrictions.conf; 
    include conf.d/wp/wordpress.conf; 
} 

的whitelisted.conf包括許可IP的負載，我將不會發佈列表中，但它結束：

... 
    allow 1.2.3.4; 

    # DROP THE WORLD # 
    deny all; 

的restrictions.conf我添加了新的拒絕規則（最後一個）：

# Global restrictions configuration file. 
# Designed to be included in any server {} block. 
location = /favicon.ico { 
     log_not_found off; 
     access_log off; 
} 

location = /robots.txt { 
     allow all; 
     log_not_found off; 
     access_log off; 
} 

# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac). 
# Keep logging the requests to parse later (or to pass to firewall utilities such as fail2ban) 
location ~ /\. { 
     deny all; 
} 

# Block PHP files in uploads, content, and includes directory. 
location ~* /(?:uploads|files|wp-content|wp-includes)/.*\.php$ { 
    deny all; 
} 

# location ~ ^/(wp-admin|wp-login\.php) { 
       allow 1.2.3.4 
       deny all; 
} 

wordpress.conf文件是：

# WordPress single site rules. 
# Designed to be included in any server {} block. 

# This order might seem weird - this is attempted to match last if rules below fail. 
# http://wiki.nginx.org/HttpCoreModule 
location/{ 
    try_files $uri $uri/ /index.php?$args; 
} 

# Add trailing slash to */wp-admin requests. 
rewrite /wp-admin$ $scheme://$host$uri/ permanent; 

# Directives to send expires headers and turn off 404 error logging. 
location ~* ^.+\. (ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|rss|atom|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$ { 
    access_log off; log_not_found off; expires max; 
} 

# Block PHP files in uploads directory. 
location ~* /(?:uploads|files)/.*\.php$ { 
    deny all; 
} 

# Block PHP files in content directory. 
location ~* /wp-content/.*\.php$ { 
    deny all; 
} 

# Block PHP files in includes directory. 
location ~* /wp-includes/.*\.php$ { 
    deny all; 
} 

# Block PHP files in uploads, content, and includes directory. 
location ~* /(?:uploads|files|wp-content|wp-includes)/.*\.php$ { 
    deny all; 
} 

# Pass all .php files onto a php-fpm/php-fcgi server. 
location ~ [^/]\.php(/|$) { 
    fastcgi_split_path_info ^(.+?\.php)(/.*)$; 
    if (!-f $document_root$fastcgi_script_name) { 
    return 404; 
    } 
    # This is a robust solution for path info security issue and works  with "cgi.fix_pathinfo = 1" in /etc/php.ini (default) 

    include fastcgi_params; 
    fastcgi_pass unix:/var/run/php-fpm/php5-fpm.sock; 
    fastcgi_index index.php; 
    include /etc/nginx/fastcgi_params; 
    fastcgi_buffer_size 128k; 
    fastcgi_buffers 256 16k; 
    fastcgi_busy_buffers_size 256k; 
    fastcgi_temp_file_write_size 256k; 
    fastcgi_read_timeout 18000; 
} 

...終於fastcgi_params是：

fastcgi_param QUERY_STRING  $query_string; 
fastcgi_param REQUEST_METHOD  $request_method; 
fastcgi_param CONTENT_TYPE  $content_type; 
fastcgi_param CONTENT_LENGTH  $content_length; 

fastcgi_param SCRIPT_NAME  $fastcgi_script_name; 
fastcgi_param REQUEST_URI  $request_uri; 
fastcgi_param DOCUMENT_URI  $document_uri; 
fastcgi_param DOCUMENT_ROOT  $document_root; 
fastcgi_param SERVER_PROTOCOL  $server_protocol; 
fastcgi_param SCRIPT_FILENAME   $document_root$fastcgi_script_name; 
fastcgi_param PATH_INFO  $fastcgi_script_name; 

fastcgi_param GATEWAY_INTERFACE CGI/1.1; 
fastcgi_param SERVER_SOFTWARE  nginx/$nginx_version; 

fastcgi_param REMOTE_ADDR  $remote_addr; 
fastcgi_param REMOTE_PORT  $remote_port; 
fastcgi_param SERVER_ADDR  $server_addr; 
fastcgi_param SERVER_PORT  $server_port; 
fastcgi_param SERVER_NAME  $server_name; 

# PHP only, required if PHP was built with --enable-force-cgi-redirect 
fastcgi_param REDIRECT_STATUS  200; 

欣賞別人指着我在正確的方向。非常感謝。

Answer 1

在您的配置，PHP文件由以下模塊進行處理：

location ~ [^/]\.php(/|$) { 
    fastcgi_split_path_info ^(.+?\.php)(/.*)$; 
    if (!-f $document_root$fastcgi_script_name) { 
     return 404; 
    } 
    include fastcgi_params; 
    fastcgi_pass unix:/var/run/php-fpm/php5-fpm.sock; 
    fastcgi_index index.php; 
    include /etc/nginx/fastcgi_params; 
    fastcgi_buffer_size 128k; 
    fastcgi_buffers 256 16k; 
    fastcgi_busy_buffers_size 256k; 
    fastcgi_temp_file_write_size 256k; 
    fastcgi_read_timeout 18000; 
} 

通過添加location ~ ^/(wp-admin|wp-login\.php) { ... }你轉移這些URI爲靜態文件進行處理。

一種解決方法是複製所有必需的FastCGI語句到新的位置，使nginx過程中的URI作爲PHP文件，例如：

location ~ ^/(wp-admin|wp-login\.php) { 
    allow 1.2.3.4 
    deny all; 

    fastcgi_split_path_info ^(.+?\.php)(/.*)$; 
    if (!-f $document_root$fastcgi_script_name) { 
     return 404; 
    } 
    include fastcgi_params; 
    fastcgi_pass unix:/var/run/php-fpm/php5-fpm.sock; 
    fastcgi_index index.php; 
    include /etc/nginx/fastcgi_params; 
}