IP.Board IPB v4.1.x Files

Yup, he has to adapt the rules to account for the subdir which I have done and no problems at all except for this one but with the rule I wrote it works just fine.

---

 

Code:

server {
  listen 443 ssl http2;
  server_name domain.com;

  ssl_dhparam /usr/local/nginx/conf/ssl/domain.com/dhparam.pem;
  ssl_certificate  /usr/local/nginx/conf/ssl/domain.com/domain.com.crt;
  ssl_certificate_key  /usr/local/nginx/conf/ssl/domain.com/domain.com.key;
  include /usr/local/nginx/conf/ssl-include.conf;
  # Mozilla Recommended
  ssl_ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:!CAMELLIA:!DES-CBC3-SHA;
  ssl_prefer_server_ciphers  on;
  add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
  add_header  X-Content-Type-Options "nosniff";
  #add_header X-Frame-Options DENY;
  ssl_buffer_size 1400;
  ssl_session_tickets on;

  # enable ocsp stapling
  resolver 8.8.8.8;
  ssl_stapling on;
  ssl_stapling_verify on;
  ssl_trusted_certificate /usr/local/nginx/conf/ssl/domain.com/ssl-trusted.crt;

  # ngx_pagespeed & ngx_pagespeed handler
  # include /usr/local/nginx/conf/pagespeed.conf;
  # include /usr/local/nginx/conf/pagespeedhandler.conf;
  # include /usr/local/nginx/conf/pagespeedstatslog.conf;

  # Limit Connections Per IP Address
  #limit_conn limit_per_ip 16;
  # ssi on

  access_log /home/nginx/domains/domain.com/log/access.log combined buffer=256k flush=60m;
  error_log /home/nginx/domains/domain.com/log/error.log;

  root /home/nginx/domains/domain.com/public;

  # prevent access to ./directories and files
  location ~ (?:^|/)\. {
      deny all;
  } 

  location / {

      # block common exploits, sql injections etc
      include /usr/local/nginx/conf/block.conf;

      try_files     $uri $uri/ /index.php;
  }

  location ~^(/page/).*(\.php)$ {
      try_files  $uri $uri/ /index.php;
  }
  # Mask fake admin directory
  location ~^/forum/admin/(.*)$ {
      deny all;
  }
  # IP.Board PHP/CGI Protection

  location ~^(/forum/uploads/).*(\.php)$ {
      deny  all;
  }
  location ~^(/forum/system/).*(\.php)$ {
      deny  all;
  }
  location ~^(/forum/datastore/).*(\.php)$ {
      deny  all;
  }
  location ~^(/forum/plugins/).*(\.php)$ {
      deny  all;
  }
  location ~^(/forum/applications/cms/).*(\.php)$ {
      deny  all;
  }

  location ~^(/forum/applications/core/).*(\.php)$ {
      deny  all;
  }

  location ~^(/forum/applications/forums/).*(\.php)$ {
      deny  all;
  }
  location ~^(/forum/applications/nexus/).*(\.php)$ {
      deny  all;
  }

  # Allow access to imageproxy
  location ^~ /forum/applications/core/interface/imageproxy/imageproxy.php {
      include /usr/local/nginx/conf/php.conf;
      allow  all;
  }

  # Allow access to JS file
  location ^~ /forum/applications/core/interface/js/js.php {
      include /usr/local/nginx/conf/php.conf;
      allow  all;
  }

  include /usr/local/nginx/conf/staticfiles.conf;
  include /usr/local/nginx/conf/php.conf;
  include /usr/local/nginx/conf/drop.conf;
  #include /usr/local/nginx/conf/errorpage.conf;
  include /usr/local/nginx/conf/vts_server.conf;
}

This is how my config looks, forum is installed in forum subdir, one extra thing to note is that I have IP.Pages installed at the root. You cannot make one config file for everyone, unfortunately. They will need to adopt a few things.

 

If you want to preserve visitors IP, I recommend you do it on PHP side/CMS option/config.php.
And remove all those overhead from Nginx .

 

Just a heads up. Be careful when using

Code:

    location ~^(/applications/blog/).*(\.php)$ {
        deny     all;
    }

    location ~^(/applications/calendar/).*(\.php)$ {
        deny     all;
    }

    location ~^(/applications/chat/).*(\.php)$ {
        deny     all;
    }

    location ~^(/applications/cms/).*(\.php)$ {
        deny     all;
    }

    location ~^(/applications/core/).*(\.php)$ {
        deny     all;
    }

    location ~^(/applications/downloads/).*(\.php)$ {
        deny     all;
    }

    location ~^(/applications/forums/).*(\.php)$ {
        deny     all;
    }

    location ~^(/applications/gallery/).*(\.php)$ {
        deny     all;
    }

    location ~^(/applications/nexus/).*(\.php)$ {
        deny     all;
    }

Seems like more files than only imageproxy and the JS files needs to be accessible directly.
E.g. for nexus, the billing API's need to be accessible.
It seems like only files that are in the interface folder(s) need to be direct accessible so something like access to

Code:

location ~^(/applications/*/interface/).*(\.php)$ {
  allow all;
}

should work fine, I have not tested it however.

 

Either remove them or try adding the location I mentioned above.
Security issue, I don't think so as IPS already checks in the files if it is being accessed directly and does not execute the script if it is not permitted.

 

Yep either add the location I mentioned OR remove the ones listed.