Nginx 配置加固
#限制，非GET POST请求链接
if ($request_method !~ ^(GET|POST)$ ) {
return 405;
}
#拒绝User-Agent链接请求
if ($http_user_agent ~* LWP::Simple|BBBike|wget|curl) {
return 444;
}
#禁止访问所有目录下的sql|log|txt|jar|war|sh|py后缀的文件
location ~.*\.(bak|save|sh|mdb|svn|git|old|log|txt|jar|war|sh|py) {
deny all;
}
#过滤url 参数敏感字
if ($query_string ~* "union.*select.*\(") {
return 404;
}
# 防止sql注入
if ($request_uri ~* "(cost\()|(concat\()") { return 403; }
if ($request_uri ~* "[+|(%20)]union[+|(%20)]") { return 403; }
if ($request_uri ~* "[+|(%20)]and[+|(%20)]") { return 403; }
if ($request_uri ~* "[+|(%20)]select[+|(%20)]") { return 403; }
if ($request_uri ~* "[+|(%20)]or[+|(%20)]") { return 403; }
if ($request_uri ~* "[+|(%20)]delete[+|(%20)]") { return 403; }
if ($request_uri ~* "[+|(%20)]update[+|(%20)]") { return 403; }
if ($request_uri ~* "[+|(%20)]insert[+|(%20)]") { return 403; }
#自动防护
if ($request_uri ~* \.(htm|do)\?(.*)$) {
set $req $2;
}
if ($req ~* "(cost\()|(concat\()") {
return 503;
}
if ($req ~* "union[+|(%20)]") {
return 503;
}
if ($req ~* "and[+|(%20)]") {
return 503;
}
if ($req ~* "select[+|(%20)]") {
return 503;
}
#溢出攻击过滤
set $block_common_exploits 0;
if ($query_string ~ “(<|%3C).*script.*(>|%3E)”) {
set $block_common_exploits 1;
}
if ($query_string ~ “proc/self/environ”) {
set $block_common_exploits 1;
}
if ($query_string ~ “base64_(en|de)code\(.*\)”) {
set $block_common_exploits 1;
}
if ($block_common_exploits = 1) {
return 444;
}
# 禁spam字段
set $block_spam 0;
if ($query_string ~ "b(ultram|unicauca|valium|viagra|vicodin|xanax|ypxaieo)b") {
set $block_spam 1;
}
if ($query_string ~ "b(erections|hoodia|huronriveracres|impotence|levitra|libido)b") {
set $block_spam 1;
}
if ($query_string ~ "b(ambien|bluespill|cialis|cocaine|ejaculation|erectile)b") {
set $block_spam 1;
}
if ($query_string ~ "b(lipitor|phentermin|pro[sz]ac|sandyauer|tramadol|troyhamby)b") {
set $block_spam 1;
}
if ($block_spam = 1) {
return 444;
}
# 禁止国外IP
