Beta Branch update tools/autoprotect.sh add .autoprotect-bypass file option

update tools/autoprotect.sh add .autoprotect-bypass file option

Give end user option to manually bypass autoprotect.sh script and NOT create a nginx deny all location match by manually creating a .autoprotect-bypass file within the directory you want to bypass and exclude from autoprotect.sh. You may want to do this if your nginx deny location match for a directory involves whitelisting ip addresses' access to the directory. The autoprotect.sh has no way of detecting if you already setup a nginx deny location match for a directory but also added whitelisted ips for the nginx location so will try to generate a nginx deny all rule if .htaccess file is in the directory with contents of 'deny from all' text. If you manually create a /privatedirectoryname/.autoprotect-bypass file, autoprotect.sh script skips generating the nginx deny all rule.

Continue reading...

123.09beta01 branch

• Branch: https://github.com/centminmod/centminmod/tree/123.09beta01
• Commit History: https://github.com/centminmod/centminmod/commits/123.09beta01

---

 

hmm what's output for this command - replace domain.com with your actual domain name

Code (Text):

find /home/nginx/domains/domain.com -name ".htaccess" -print0 | xargs -0 echo | grep "domain.com/public"

and

Code (Text):

grep -iR 'Deny from all' /home/nginx/domains/domain.com/*

 

that is all i check for .htaccess and then derive the path to .htaccess

hmmm it must be matching on the

Code (Text):

grep "domain.com/public"

 

strange not seeing it on my test server

Code (Text):

find /home/nginx/domains/testdomain9.com -name ".htaccess" -print0 | xargs -0 echo | grep "testdomain9.com/public"
/home/nginx/domains/testdomain9.com/public/testdir10/.htaccess /home/nginx/domains/testdomain9.com/public/testdir13/.htaccess /home/nginx/domains/testdomain9.com/public/testdir4/.htaccess /home/nginx/domains/testdomain9.com/public/testdir11/.htaccess /home/nginx/domains/testdomain9.com/public/testdir9/.htaccess /home/nginx/domains/testdomain9.com/public/testdir2/.htaccess /home/nginx/domains/testdomain9.com/public/testdir5/.htaccess /home/nginx/domains/testdomain9.com/public/testdir/.htaccess /home/nginx/domains/testdomain9.com/public/testdir7/.htaccess /home/nginx/domains/testdomain9.com/public/testdir3/.htaccess /home/nginx/domains/testdomain9.com/public/testdir8/.htaccess /home/nginx/domains/testdomain9.com/public/testdir12/.htaccess /home/nginx/domains/testdomain9.com/public/testdir6/.htaccess /home/nginx/domains/testdomain9.com/public/testdir111/.htaccess

 

Ah i see, i guess i need to check for 'deny from all' earlier in script

but what's output for you

Code (Text):

grep -i 'Deny from all' "/home/nginx/domains/domain.com/public/.htaccess" >/dev/null 2>&1; echo $?

and

Code (Text):

grep -i 'Deny from all' "/home/nginx/domains/domain.com/public/.htaccess"

 

that means .htaccess in web root had deny from all so is correct autoprotect.sh does not touch contents of .htaccess just reads it for deny from all

 

oh i see it matched on that then.. need to revise the check

 

actually latest autoprotect.sh update should of fixed it in 123.09beta01

 

why is it still causing problems ? fixing the problems would be better - feedback

 

If you have a directory with .htaccess in it with deny from all, it will trigger autoprotect unless you add to directory a file, .autoprotect-bypass i.e. /privatedirectoryname/.autoprotect-bypass or remove that .htaccess file as it's useless on nginx anyway.

But if you script has .htaccess with deny from all it, then developer of that script intended for that directory to be not accessible on Apache so should be same for Nginx = not accessible. This is where security could be compromised for a web app script which was written for Apache in mind with .htaccess deny from all that is migrated to Nginx as it leaves the intended no access directories open on Nginx if autoprotect.sh didn't exist.

 

in that case probably best to just temporary add a .autoprotect-bypass file to that directory and then remove it after the developer has accessed it

 

check if it exists ?

Code (Text):

 ls -lah /usr/bin/ngxrestart
-rwx------. 1 root root 22 May 20 18:07 /usr/bin/ngxrestart

Oh i see the problem similar to @pamamolf reported at Autoprotect nginx wrong path | Centmin Mod Community the cronjob is incorrect linked to /root/centminmod-123.09beta01/tools/autoprotect.sh instead of /usr/local/src/centminmod/tools/autoprotect.sh