Nginx Directory Access Restriction - Revision history

SarahK at 20:27, 26 April 2022

2022-04-26T20:27:19Z

SarahK at 19:51, 30 September 2021

2021-09-30T19:51:38Z

Matt: /* For cPanel environments */

2020-01-28T18:58:03Z

‎For cPanel environments

David: /* The Deny Directive */

2020-01-28T17:22:49Z

‎The Deny Directive

Matt: /* For cPanel environments */

2020-01-28T14:11:07Z

‎For cPanel environments

Matt: /* For non-cPanel environments */

2020-01-28T13:31:24Z

‎For non-cPanel environments

Matt at 13:29, 28 January 2020

2020-01-28T13:29:06Z

Matt at 01:17, 28 January 2020

2020-01-28T01:17:28Z

Matt: Created page with "This document explains how to add protection for a directory on a server that runs NGINX. NGINX does not read .htaccess files and any restrictions set with a .htaccess file w..."

2020-01-28T01:17:11Z

Created page with "This document explains how to add protection for a directory on a server that runs NGINX. NGINX does not read .htaccess files and any restrictions set with a .htaccess file w..."

New page

This document explains how to add protection for a directory on a server that runs NGINX.

NGINX does not read .htaccess files and any restrictions set with a .htaccess file will not apply. WHMCS uses a .htaccess file to protect the <code>/vendor/</code> directory. This directory loses its protection on servers that runs NGINX. The below guide demonstrates how to restrict access to this directory.

==Restricting Directory Access==

<div class="docs-alert-info">The following steps <strong>require root access</strong> to the server running NGINX. If you do not have root, you will need to contact your web hosting provider or server administrator.</div>

# Login to the web server.
# Locate the Nginx configuration template (see "Locating the Nginx configuration template")
# Add the deny directive (a sample is provided below) to the server block of your site's configuration
# Save your changes and restart Nginx

==The Deny Directive==

<pre>
server {
location ~ /vendor/ {
deny all;
return 403;
}
...
}
</pre>

<div class="docs-alert-danger">Important: You must add this location directive to the top of your server block configuration.</div>

==Locating the Nginx configuration file==

Nginx has a very flexible configuration organization. Because of this, your configuration file may be in a number of different places.

===cPanel & WHM===
The following path is the default location for the Nginx configuration file on cPanel & WHM servers:
<div class="source-cli">/etc/nginx/conf.d/users/<username>.conf</div>

===Debian & Ubuntu===
The following path is the most common location:
<div class="source-cli">/etc/nginx/sites-available/default</div>
Often times administrators will setup configuration files for each site individually. In this case, you can often find the configuration files for each domain in the /sites-available directory:
<div class="source-cli">/etc/nginx/sites-available/example.com</div>

==None of the above==
If the configuration file is not found in any of the above locations, at the command prompt, run the following command:
<div class="source-cli">nginx -t</div>
The output should display the current directory path to your server's Nginx configuration file. The output will should resemble the following example:
<div class="source-cli">
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok<br>
nginx: configuration file /etc/nginx/nginx.conf test is successful
</div>
To check if the Nginx configuration file contains any include directives, run the following command:
<div class="source-cli">grep include /etc/nginx/nginx.conf</div>
If the grep command does not return any output, then you can proceed with your changes to the configuration. If the grep command returns any includes, you must check each include file for the server directive. The following grep command output example displays an Nginx configuration file that contains includes:
<div class="source-cli">
include /etc/nginx/modules-enabled/*.conf;<br>
include /etc/nginx/mime.types;<br>
include /etc/nginx/conf.d/*.conf;<br>
include /etc/nginx/sites-enabled/*;
</div>

If none are found, the `server` block should be found in the config file found with `nginx -t`.

If included configuration files are found, it will be necessary to check each of the included files for the `server` directive.

==Restarting Nginx==
After making any configuration changes to Nginx, it is necessary to reload the Nginx config.

===cPanel & WHM===
Run the following command:
<div class="source-cli">/usr/local/cpanel/scripts/restartsrv_nginx</div>
===Other Operating Systems===
CentOS 6:
<div class="source-cli">/etc/init.d/nginx reload</div>
CentOS 7:
<div class="source-cli">systemctl reload nginx.service</div>
Debian/Ubuntu:
<div class="source-cli">systemctl reload nginx</div>

@@ Line 9: / Line 9: @@
 <div class="docs-alert-info">The following steps <strong>require root access</strong> to the server running NGINX. If you do not have root, you will need to contact your web hosting provider or server administrator.</div>
-# Login to the web server.
+# Log in to the web server.
-# Locate the Nginx configuration template (see "Locating the Nginx configuration file")
+# Locate the Nginx configuration template (see "Locating the Nginx configuration file").
-# Add the deny directive (see "The Deny Directive") to the server block of your site's configuration
+# Add the deny directive (see "The Deny Directive") to the server block of your site's configuration.
-# Save your changes and restart Nginx
+# Save your changes and restart Nginx.
 ===For cPanel environments===

@@ Line 18: / Line 18: @@
 You can use cPanel's Directory Privacy interface (Home >> cPanel >> Files >> Directory Privacy) to add protection to this directory.
-<div class="docs-alert-warning">Note: cPanel's Directory Privacy interface (Home >> cPanel >> Files >> Directory Privacy) only support this process in cPanel & WHM version 84 and later. </div>
+<div class="docs-alert-warning">Note: cPanel's Directory Privacy interface (Home >> cPanel >> Files >> Directory Privacy) only supports this process in cPanel & WHM version 84 and later. On a server that runs cPanel & WHM version 82 and earlier, use the non-cPanel environment steps.</div>
 To protect the directory, perform the following steps:

@@ Line 25: / Line 25: @@
 #Select the Password protect this directory checkbox.
 #Enter a display label in the Enter a name for the protected directory text box. <div class="docs-alert-info">Note: This name only functions as a label for the directory. Do not confuse it with the directory’s actual name.</div>
 #Click Save. A confirmation message will appear. Click Go Back to return to the directory's configuration.
 ==The Deny Directive==

@@ Line 16: / Line 16: @@
 ===For cPanel environments===
-You can use cPanel's Directory Privacy interface (Home >> cPanel >> Files >> Directory Privacy) to add protection to this directory.
+You can use cPanel's '''Directory Privacy''' interface ('''Home >> cPanel >> Files >> Directory Privacy''') to add protection to this directory.
-<div class="docs-alert-warning">Note: cPanel's Directory Privacy interface (Home >> cPanel >> Files >> Directory Privacy) only supports this process in cPanel & WHM version 84 and later. On a server that runs cPanel & WHM version 82 and earlier, use the non-cPanel environment steps.</div>
+<div class="docs-alert-warning">
 To protect the directory, perform the following steps:
-#Select the /whmcs/vendor directory in cPanel's Directory Privacy interface (Home >> cPanel >> Files >> Directory Privacy).
+# Select the <tt>/whmcs/vendor</tt> directory in cPanel's '''Directory Privacy''' interface ('''Home >> cPanel >> Files >> Directory Privacy''').
-#Select the Password protect this directory checkbox.
+# Select the '''Password protect this directory''' checkbox.
-#Enter a display label in the Enter a name for the protected directory text box. <div class="docs-alert-info">Note: This name only functions as a label for the directory. Do not confuse it with the directory’s actual name.</div>
+# Enter a display label in the '''Enter a name for the protected directory''' text box. <div class="docs-alert-info"> This name only functions as a label for the directory. Do not confuse it with the directory’s actual name.</div>
-#Click Save. A confirmation message will appear. Click Go Back to return to the directory's configuration.
+#Click '''Save'''. A confirmation message will appear. Click '''Go Back''' to return to the directory's configuration.
 ==The Deny Directive==
@@ Line 39: / Line 41: @@
 </pre>
-<div class="docs-alert-danger">Important: You must add this location directive to the top of your server block configuration.</div>
+<div class="docs-alert-danger">
 ==Locating the Nginx configuration file==
@@ Line 47: / Line 51: @@
 ===cPanel & WHM===
 The following path is the default location for the Nginx configuration file on cPanel & WHM servers:
 <div class="source-cli">/etc/nginx/conf.d/users/<username>.conf</div>
 ===Debian & Ubuntu===
 The following path is the most common location:
 <div class="source-cli">/etc/nginx/sites-available/default</div>
-Often times administrators will setup configuration files for each site individually. In this case, you can often find the configuration files for each domain in the /sites-available directory:
 <div class="source-cli">/etc/nginx/sites-available/example.com</div>
 ===None of the above===
 If the configuration file is not found in any of the above locations, at the command prompt, run the following command:
 <div class="source-cli">nginx -t</div>
 The output should display the current directory path to your server's Nginx configuration file. The output will should resemble the following example:
 <div class="source-cli">
 nginx: the configuration file /etc/nginx/nginx.conf syntax is ok<br>
 nginx: configuration file /etc/nginx/nginx.conf test is successful
 </div>
 To check if the Nginx configuration file contains any include directives, run the following command:
 <div class="source-cli">grep include /etc/nginx/nginx.conf</div>
 If the grep command does not return any output, then you can proceed with your changes to the configuration.  If the grep command returns any includes, you must check each include file for the server directive. The following grep command output example displays an Nginx configuration file that contains includes:
 <div class="source-cli">
 include /etc/nginx/modules-enabled/*.conf;<br>
@@ Line 78: / Line 95: @@
 ==Restarting Nginx==
 After making any configuration changes to Nginx, it is necessary to reload the Nginx config.
 ===cPanel & WHM===
 Run the following command:
 <div class="source-cli">/usr/local/cpanel/scripts/restartsrv_nginx</div>
 ===Other Operating Systems===
 CentOS 6:
 <div class="source-cli">/etc/init.d/nginx reload</div>
 CentOS 7:
 <div class="source-cli">systemctl reload nginx.service</div>
 Debian/Ubuntu:
 <div class="source-cli">systemctl reload nginx</div>

@@ Line 31: / Line 31: @@
 <pre>
 server {
-     location ~ /vendor/ {
+     location ^~ /vendor/ {
          deny all;
          return 403;

@@ Line 4: / Line 4: @@
 ==Restricting Directory Access==
 <div class="docs-alert-info">The following steps <strong>require root access</strong> to the server running NGINX. If you do not have root, you will need to contact your web hosting provider or server administrator.</div>
@@ Line 11: / Line 13: @@
 # Add the deny directive (a sample is provided below) to the server block of your site's configuration
 # Save your changes and restart Nginx
 ==The Deny Directive==