Nginx I'm missing the error in this nginx config. Help?

if you disable the autoprotect include file, does it work

Code (Text):

 include /usr/local/nginx/conf/autoprotect/mydomain.org/autoprotect-mydomain.org.conf;

If on Centmin Mod 123.09beta01 or higher, you may have ran into the new tools/autoprotect.sh cronjob feature outlined at Beta Branch - autoprotect.sh - apache .htaccess check & migration to nginx deny all | Centmin Mod Community Your uploaded scripts may have .htaccess deny from all type files in their directories which may need bypassing autoprotect. It's a security feature that no other nginx based stack has as far as I know

So instead, all .htaccess 'deny from all' detected directories now get auto generated Nginx equivalent location match and deny all setups except if you want to manually bypass the directory from auto protection via a .autoprotect-bypass file - details below here.

You can read a few threads below on how autoprotect.sh may have caught some folks web apps falsely and the workarounds or improvements made to autoprotect.sh with the help of users feedback and troubleshooting.

• Is it better to add an exeption for 127.0.0.1 for autoprotect rules? | Centmin Mod Community
• IP.Board - Query on autoprotect + IPB forums | Centmin Mod Community
• Wordpress - Akismet JS and CSS - Forbidden? | Centmin Mod Community
• Nginx - Error 403 nginx with sngine script

Check if your nginx vhost at either or both /usr/local/nginx/conf/conf.d/domain.com.conf and/or /usr/local/nginx/conf/conf.d/domain.com.ssl.conf has include file for autoprotect example

Code (Text):

include /usr/local/nginx/conf/autoprotect/domain.com/autoprotect-domain.com.conf;

see if your directory for the script which has issues is caught in an autoprotect include entry in /usr/local/nginx/conf/autoprotect/domain.com/autoprotect-domain.com.conf which has a deny all entry

Code (Text):

cat /usr/local/nginx/conf/autoprotect/domain.com/autoprotect-domain.com.conf

i.e.

Code (Text):

# /home/nginx/domains/domain.com/public/subdirectory/js
location ~* ^/subdirectory/js/ { allow 127.0.0.1; deny all; }

If caught you can whitelist it by autoprotect bypass .autoprotect-bypass file - details below here. So if problem js file is at domain.com/subdirectory/js/file.js then it is likely /subdirectory/js has a .htaccess with deny all in it - make sure that directory is meant to be publicly accessible by contacting author of script and if so, you can whitelist it and re-run autoprotect script to regenerate your /usr/local/nginx/conf/autoprotect/domain.com/autoprotect-domain.com.conf include file

Code (Text):

cd /home/nginx/domains/domain.com/public/subdirectory/js
touch .autoprotect-bypass
/usr/local/src/centminmod/tools/autoprotect.sh
nprestart

it maybe you need to also whitelist /subdirectory then it would be as follows creating bypass files at /home/nginx/domains/domain.com/public/subdirectory/.autoprotect-bypass and /home/nginx/domains/domain.com/public/subdirectory/js/.autoprotect-bypass

Code (Text):

cd /home/nginx/domains/domain.com/public/subdirectory/
touch .autoprotect-bypass
cd /home/nginx/domains/domain.com/public/subdirectory/js
touch .autoprotect-bypass
/usr/local/src/centminmod/tools/autoprotect.sh
nprestart

then double check to see if updated /usr/local/nginx/conf/autoprotect/domain.com/autoprotect-domain.com.conf include file now doesn't show an entry for /subdirectory/js

 

Probably could, but the point of autoprotect is to alert end users like yourself of Apache server only .htaccess supported files in your web site code base which won't work with Nginx so you can address it at Nginx config file level or via the above mentioned autoprotect bypass method

So in your case you had an Apache .htaccess in public web root / which you should look into if you need to setup manually an Nginx configuration to address it or just bypass and ignore it.

 

The nginx failing to load due to config error would be the alert usually for ones at web root. For others it would just be auto generated workarounds in /usr/local/nginx/conf/autoprotect/domain.com/autoprotect-domain.com.conf include file

 

FYI, autoprotect updates run on a cronjob, so you will know sooner than a server reboot, at least a nginx restart. So nginx upgrade/recompile isn't only time you'll know. You'd know within less than <24hrs from initial Nginx vhost creation where you have uploaded your site's code and the offending .htaccess files.

Code (Text):

crontab -l | grep autoprotect
13 23 * * * /usr/local/src/centminmod/tools/autoprotect.sh >/dev/null 2>&1

But yes, I understand what you mean, so a better way to inform folks would be ideal. Or to check for existing location paths.

 

Yes that is how to date autoprotect.sh alerted folks to the potential issue, downtime is arguably better than an Apache .htaccess intended private directory in Wordpress plugin being public revealed and accessible on Nginx server due to Nginx not supporting .htaccess file method of blocking directory access. Some Wordpress plugins save debug logs to publicly access directories and rely on .htaccess in that directory to prevent public access which only works on Apache servers and not Nginx servers.

Guess my predicament is finding a better way without hand holding end users to educate them on Nginx and .htaccess files for everytime an unknown script/plugin utilises Apache only supported .htaccess files on Centmin Mod Nginx.

I created a test updated tools/autoprotect.sh at Updated Centmin Mod tools/autoprotect.sh August 9, 2023 you can try to replace /usr/local/src/centminmod/tools/autoprotect.sh with via command below

Code (Text):

wget -O /usr/local/src/centminmod/tools/autoprotect.sh https://gist.githubusercontent.com/centminmod/316da21874fa0dbe779c49f13cb1004f/raw/autoprotect.sh
chmod +x /usr/local/src/centminmod/tools/autoprotect.sh

then manually run
/usr/local/src/centminmod/tools/autoprotect.sh to regenerate the autoprotect include files

Code (Text):

/usr/local/src/centminmod/tools/autoprotect.sh

The updated version does skip generating autoprotect include file entries if it detects the location path context in existing Nginx vhost config files to lessen the number of duplicate location path errors. But it won't resolve when path directory has a deny all .htaccess detected by autoprotect.sh that isn't already covered in existing Nginx vhost config files.

If folks don't like autoprotect method, they can just comment out with hash # in front of /usr/local/nginx/conf/autoprotect/domain.com/autoprotect-domain.com.conf include file in their Nginx vhosts. Then Nginx will act just like regular non-Centmin Mod Nginx setups that ignore .htaccess Apache deny all based files without any form of notice (errors) to users that they need to add specific Nginx location deny protections to cover paths with .htaccess.