Macetes TI: nginx

Mostrando postagens com marcador nginx. Mostrar todas as postagens

Apache get real IP from NGINX proxy

nginx:

set_real_ip_from 0.0.0.0/0;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;

service nginx reload

##################################
apache2:

a2enconf remoteip
a2enmod remoteip

pico /etc/apache2/conf-available/remoteip.conf

add:
RemoteIPHeader X-Forwarded-For
RemoteIPInternalProxy <IP_NGINX>

service apache2 restart

NGINX as a load balancer for WebSocket

To configure NGINX as a secure load balancer for WebSocket (wss://) connections,use an HTTP upgrade map, increase connection timeouts, and configure SSL termination.

Complete NGINX Configuration Example

Add this configuration inside your nginx.conf or site configuration file:

nginx

http {
    # Map dynamic connection upgrade headers
    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
    }

    upstream websocket_backend {
        ip_hash; # Ensures sticky sessions for client connections
        server ://example.com;
        server ://example.com;
    }

    server {
        listen 443 ssl;
        server_name yourdomain.com;

        # SSL/TLS Certificates for WSS termination
        ssl_certificate /path/to/fullchain.pem;
        ssl_certificate_key /path/to/privkey.pem;

        location / {
            proxy_pass http://websocket_backend;
            
            # Required for WebSocket handshake
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            
            # Standard proxy headers
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # Prevent idle timeouts from dropping long-lived connections (set to 24 hours)
            proxy_read_timeout 86400s;
            proxy_send_timeout 86400s;
            
            # Disable buffering for real-time data streaming
            proxy_buffering off;
        }
    }

    # Optional: Redirect HTTP to HTTPS
    server {
        listen 80;
        server_name yourdomain.com;
        return 301 https://$host$request_uri;
    }
}

NGINX - To allow a specific User-Agent from one IP address only

Step 1: Define the Map BlocksAdd this configuration inside the http {} block of your /etc/nginx/nginx.conf file. This logic evaluates the incoming User-Agent and IP address to flag unauthorized requests

http {
# ... your existing http config ...

# 1. Check if the User-Agent matches the restricted one
map $http_user_agent $is_restricted_ua {
default 0;
"~*YourCustomUserAgent" 1; # Replace with your target User-Agent (regex matching)
}

# 2. Check if the client IP is NOT the authorized one
map $remote_addr $is_unauthorized_ip {
default 1;
"192.168.1.50" 0; # Replace with your ONLY allowed IP address
}

# 3. Combine both conditions: Flag if it's the target UA AND an unauthorized IP
map "$is_restricted_ua$is_unauthorized_ip" $block_request {
default 0;
"11" 1; # 1 (Restricted UA) + 1 (Unauthorized IP) = Block
}
}

Step 2: Apply the Block RuleOpen your website's specific server configuration file (e.g., inside /etc/nginx/sites-available/) and use the combined variable to reject requests with a 403 Forbidden error.

server {
listen 80;
server_name yourdomain.com;

# Place this rule globally inside the server block or inside a specific location block
if ($block_request) {
return 403;
}

location / {
# ... your standard site configuration ...
}
}

Add nginx repository Ubuntu

# 1. Download the NGINX signing key
curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor | sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null

# 2. Add the NGINX Repository
echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://nginx.org/packages/mainline/ubuntu `lsb_release -cs` nginx" | sudo tee /etc/apt/sources.list.d/nginx.list

echo -e "Package: *\nPin: origin nginx.org\nPin: release o=nginx\nPin-Priority: 900" | sudo tee /etc/apt/preferences.d/99nginx

NGINX upstream sent too big

upstream sent too big header while reading response header from upstream

Add:

fastcgi_buffers 16 16k;
fastcgi_buffer_size 32k;
proxy_buffer_size   128k;
proxy_buffers   4 256k;
proxy_busy_buffers_size   256k;

To server{} in nginx.conf

Block scraper bots nginx

For those not using wordpress at all and just want to block annoying scraper bots:

location ~* /wp- {
    deny all;
}

or better yet:

location ~* /wp- {
    return 302 https://www.youtube.com/watch?v=dQw4w9WgXcQ;
}

source:https://gist.github.com/nfsarmento/57db5abba08b315b67f174cd178bea88

Blocking access by user agent in Nginx

How to block access by user agent in Nginx. In this configuration, i will use ngx_http_map_module.

Inside http section:

include /etc/nginx/blacklist;

Inside server section (virtual host). We will return 444 status code.

if ($block_ua) {
        return 444;
}

The blacklist file (example)

map $http_user_agent $block_ua {
        default           0;
        ~*profound        1;
        ~*scrapyproject   1;
        ~*netcrawler      1;
        ~*nmap            1;
	~*sqlmap	  1;
	~*slowhttptest	  1;
	~*nikto		  1;
	~*jersey	  1;
	~*brandwatch	  1;
	~*magpie-crawler  1;
	~*mechanize	  1;
	~*python-requests 1;
	~*redback	  1;
}

For testing:

aelius@macbook:~$ curl --head -A "profound" https://www.unixteacher.org/
curl: (52) Empty reply from server

What is http status 444 ?

A non-standard status code used to instruct nginx to close the connection without sending a response to the client, most commonly used to deny malicious or malformed requests.

Block folder access - Nginx

location /phpmyadmin {
deny all;
return 403;
}

location /phpmyadmin {

allow 192.168.1.0/24;
deny all;
return 403;
}

Nging HTTPS redirect

server {

    listen 80;
    server_name linuxize.com www.linuxize.com;
    return 301 https://linuxize.com$request_uri;
}

Macetes TI