书接上回,刚迁到服务器,东西还没完全配完,就从日志里看到不少蟑螂了!虽然是静态博客,但是看到这些蟑螂爬来爬去的还是很恶心,果断禁掉。
- 拦截各种 php 遍历
- 拦截各种不存在的 rss 遍历(只对真实路径放行)
- 拦截各种隐藏路径遍历
废话不多说,直接上配置:
server { listen 80 ; listen 443 ssl http2; server_name xaoxuu.com;
index index.html; if ($scheme = http) { return 301 https://$host$request_uri; } access_log /www/sites/xaoxuu.com/log/access.log main; error_log /www/sites/xaoxuu.com/log/error.log;
location ~* \.php$|\.asp$|\.aspx$|\.jsp$|\.cgi$ { return 403; } location ~* \.(zip|rar|tar\.gz|tgz)$ { return 403; }
location ~* ^/(rss\.xml|rss2\.xml|index\.xml|feed(/.*)?)$ { return 404; }
location ~ ^/(\.user.ini|\.htaccess|\.git|\.env|\.svn|\.project|LICENSE|README.md) { return 404; }
location ~ /\.(?!well-known).* { deny all; }
location ^~ /.well-known { allow all; root /usr/share/nginx/html; autoindex off; }
location ~* ^/\.well-known/.*\.(php|jsp|py|js|css|lua|ts|go|zip|tar\.gz|rar|7z|sql|bak)$ { return 403; }
root /www/sites/xaoxuu.com/index;
error_page 404 /404.html;
location = /404.html { root /www/sites/xaoxuu.com/index; }
ssl_certificate /path/to/fullchain.pem; ssl_certificate_key /path/to/privkey.pem; ssl_protocols TLSv1.3 TLSv1.2; ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:!aNULL:!eNULL:!EXPORT:!DSS:!DES:!RC4:!3DES:!MD5:!PSK:!KRB5:!SRP:!CAMELLIA:!SEED; ssl_prefer_server_ciphers off; ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m;
error_page 497 https://$host$request_uri;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
include /www/sites/xaoxuu.com/proxy/*.conf; }
|