IP.Board IPB v4.1.x Files

Jimmy · Sep 19, 2016

pamamolf said: ↑
I think also this one must be commented :
Code:
    # Prevent access to ./directories and files
    location ~ (?:^|/)\. {
        deny all;
}
Click to expand...
To allow access to ./directories? Why do you think that needs to be commented out?

pamamolf · Sep 19, 2016

I had some issues with it and if i am not wrong other users report some issues here on the forum and eva disable it as default on latest Centminmod versions ......

but maybe the issues was related to protected code of Centminmod and that got fixed by adding allow to 127.0.0.1 ?

cloud9 · Sep 19, 2016

Im running with it and no problems

Jimmy · Sep 19, 2016

When I'm back online I'll check it out with the latest version and do some checks to see if other people have it in their conf files (non centminmod).

eva2000 · Sep 19, 2016

pamamolf said: ↑
I think also this one must be commented :
Code:
    # Prevent access to ./directories and files
    location ~ (?:^|/)\. {
        deny all;
}
Click to expand...
i removed it from the versions i put up at Nginx Vhost & Rewrites for IP.Board - CentminMod.com LEMP Nginx web stack for CentOS

Jimmy · Sep 19, 2016

@eva2000 I think I left that in there for an extra layer of protection. It's not in Makoto's setup: https://invisionpower.com/forums/to...-a-secure-nginxphp-fpm-installation-for-ips4/

eva2000 · Sep 19, 2016

yeah can remove it as it's already in drop.conf include file that is included in all Centmin Mod Nginx generated vhost config files Nginx Vhost & Rewrites for IP.Board - CentminMod.com LEMP Nginx web stack for CentOS
Code (Text):
include /usr/local/nginx/conf/drop.conf;
I stopped renewing my IP 3.x purchased license 2yrs ago when i wrote that guide as mainly all my clients have been vB and Xenforo hehe. Less hassles just moving to Xenforo

Jimmy · Sep 19, 2016

@eva2000 that makes sense. If it's already somewhere else, than removing it is the right thing to do.

I like using Xenforo on this site... though it's the only Xenforo site I've run across - that I use. I own one license that needs to be re-activated.

SeaTea · Sep 19, 2016

Jimmy said: ↑

To allow access to ./directories? Why do you think that needs to be commented out?
Click to expand...

If you deny access to ".files", letsencrypt can not verify...

eva2000 · Sep 19, 2016

SeaTea said: ↑

If you deny access to ".files", letsencrypt can not verify...
Click to expand...

Centmin Mod takes care of that in staticfiles.conf include file But yes the position order of @pamamolf mentioned version does block letsencrypt verification.

Jimmy · Sep 19, 2016

I don't won't use Letsencrypt.

eva2000 · Sep 19, 2016

yeah but 123.09 stable will have it built into nginx vhost setup routines as an option to use letsencrypt ssl certificates for HTTPS eventually. Just needs beta testing right now

Jimmy · Sep 19, 2016

That's fine, I'm sure a lot of people are going to use it because it's free. I'll just remove it or comment it out of the vhost.

eva2000 · Sep 19, 2016

Jimmy said: ↑

That's fine, I'm sure a lot of people are going to use it because it's free. I'll just remove it or comment it out of the vhost.
Click to expand...

123.09beta01 and higher has a variable to disable letencrypt acmeotol.sh integration if you don't want it https://community.centminmod.com/th...-to-control-addons-acmetool-sh-detecti….8505/ - it's disabled by default for 123.09beta01 so users who want to test it can enable. For 123.09 stable it will be enabled by default.

Jimmy · Sep 19, 2016

eva2000 said: ↑

123.09beta01 and higher has a variable to disable letencrypt acmeotol.sh integration if you don't want it https://community.centminmod.com/th...-to-control-addons-acmetool-sh-detecti….8505/ - it's disabled by default for 123.09beta01 so users who want to test it can enable. For 123.09 stable it will be enabled by default.
Click to expand...

People running stable will be able to disable it in the conf file right?

I'm behind on the information for this integration. I'll have to read up on it and comment in the thread.

eva2000 · Sep 19, 2016

Jimmy said: ↑

People running stable will be able to disable it in the conf file right?

I'm behind on the information for this integration. I'll have to read up on it and comment in the thread.
Click to expand...

when 123.09 stable is out, like 123.09beta01 yes they'll be able to

cloud9 · Oct 16, 2016

@Jimmy perhaps add the same or similar text Eva200 has in the config for linking the readme

updated nginx HTTPS vhost template add note for HSTS in 123.09beta01 · centminmod/centminmod@0c85e94 · GitHub
Code:
+  # before enabling HSTS line below read centminmod.com/nginx_domain_dns_setup.html#hsts
   #add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
   #add_header X-Frame-Options SAMEORIGIN;
   #add_header X-Xss-Protection "1; mode=block" always;

jair · Jan 9, 2017

Hi @Jimmy

I am trying to do the same - setup IPB 4.1 with nginx, but prefer to not force the SSL yet as I am still testing and there is a lot of remote content from non-ssl websites on my forum. Anyway, what I have to do to get the vhost file in non ssl format.

I am thinking to just remove all SSL references from the top 60 lines and use the structure from the default vhost. Would that work? Is there anything in the rewrite rules below line 60 that is dependent on SSL?

Just starting with this, usually I am quick learner

Colin · Jan 9, 2017

Tagging the topic as I'm finally going to upgrade to the 4.#series. I would of migrated to XF, but for the 35+hour migration
Test server 129beta is setup as forced ssl via letsencrypt and it seems to hold up, noting the proxy features for images pasted on http resources.

Jimmy · Jan 12, 2017

jair said: ↑

Hi @Jimmy

I am trying to do the same - setup IPB 4.1 with nginx, but prefer to not force the SSL yet as I am still testing and there is a lot of remote content from non-ssl websites on my forum. Anyway, what I have to do to get the vhost file in non ssl format.

I am thinking to just remove all SSL references from the top 60 lines and use the structure from the default vhost. Would that work? Is there anything in the rewrite rules below line 60 that is dependent on SSL?

Just starting with this, usually I am quick learner
Click to expand...

Right now I'm focused on a full SSL site, so I'm not going to tackle Non-SSL issues. With that being said, I'm sure you can figure it out with some tests. Once I get my site up and running and tweak out the SSL config, I can work on a Non-SSL version.

Log in / Register

Forums

Join the community today

IP.Board IPB v4.1.x Files

Jimmy Well-Known Member

pamamolf Premium Member Premium Member

cloud9 Premium Member Premium Member

Jimmy Well-Known Member

eva2000 Administrator Staff Member

Jimmy Well-Known Member

eva2000 Administrator Staff Member

Jimmy Well-Known Member

SeaTea Member

eva2000 Administrator Staff Member

Jimmy Well-Known Member

eva2000 Administrator Staff Member

Jimmy Well-Known Member

eva2000 Administrator Staff Member

Jimmy Well-Known Member

eva2000 Administrator Staff Member

cloud9 Premium Member Premium Member

jair Member

Colin Premium Member Premium Member

Jimmy Well-Known Member

.

Log in / Register

Useful Searches

Join the community today

IP.Board IPB v4.1.x Files

Jimmy Well-Known Member

pamamolf Premium Member Premium Member

cloud9 Premium Member Premium Member

Jimmy Well-Known Member

eva2000 Administrator Staff Member

Jimmy Well-Known Member

eva2000 Administrator Staff Member

Jimmy Well-Known Member

SeaTea Member

eva2000 Administrator Staff Member

Jimmy Well-Known Member

eva2000 Administrator Staff Member

Jimmy Well-Known Member

eva2000 Administrator Staff Member

Jimmy Well-Known Member

eva2000 Administrator Staff Member

cloud9 Premium Member Premium Member

jair Member

Colin Premium Member Premium Member

Jimmy Well-Known Member

.