Category: Nginx

Expires Header In Nginx On Plesk

June 28, 2021

Trying to add an Expires header in Nginx on a Plesk server like this is problematic. The “location” directive conflicts (overrides) the “location” directive created by Plesk. The work around is to disable “Serve static files directly by nginx” but this is a valuable feature that we usually don’t want to turn off. An alternative is to use a “map” directive. Setup the map in the global nginx config by creating /etc/nginx/conf.d/expires_map.conf with: Next in the “Additional nginx directives” field add: This works well but may not be possible on a shared server where the global nginx configuration can not be changed.

Nginx Redirects With Map File

May 19, 2021

Client provided a CSV file with several thousand redirects for site hosted on Plesk server. For maximum efficiency we implemented the redirects using a map file in Nginx. Start by convert the CSV file to a map include file with one redirect per line, space delimited and terminated with a colon. For example: /source-url-1 https://acme.com/dest-url-1: /source-url-2 https://acme.com/dest-url-2: I placed the file at: /var/www/vhosts/acme.com/redirects/redirect.map Next step is to add to global nginx config by creating a file at: /etc/nginx/conf.d/redirect_maps.conf containing: Finally in Plesk, for the target subscription (acme.com) in “Apache & Nginx Setting” add the following to “Additional Nginx directives:

Diffie–Hellman (DHE) Ciphers On Nginx

November 6, 2020

In some cases you may wish to allow Diffie–Hellman (DHE) ciphers in order to support older clients like IE on Windows 7. On Plesk we often use the “intermediate” level in the Mozilla cipher set as described here: https://wiki.mozilla.org/Security/Server_Side_TLS The “intermediate” level includes: ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES256-GCM-SHA384 Of course the “ECDSA” or “Elliptic Curve Digital Signature Algorithm” ciphers will only be available if you are using ECC signed certificates. Additionally the “DHE” ciphers will not be available by default if you are using Nginx releases greater then 1.11. With the 1.11 release Nginx moved the DHE key to an external setting instead of an internally generated key. The stock Nginx packages on Ubuntu and CentoOS do not setup a DHE key which results in the DHE ciphers not being available. To address this problem, start by generating a key:

cd /etc/ssl/certs
openssl dhparam -out dhparam.pem 4096

1 2	cd /etc/ssl/certs openssl dhparam -out dhparam.pem 4096

Next tell Nginx where to find

Disable OPTIONS method in NGINX

January 2, 2019

To disable the OPTIONS method in Nginx add the following config:

if ($request_method ~ ^(OPTIONS)$ )
{
	return 403;
}

if ($request_method ~ ^(OPTIONS)$ )

{

return 403;

}

The result can be tested with curl:

curl -X OPTIONS https://domain.com

1	curl -X OPTIONS https://domain.com

Disable Basic Auth For Virtual Path On Plesk

February 16, 2018

In a recent case we needed to allow request to a particular virtual URL path on a site that was password protected with HTTP Basic Auth. The site was hosted on a Linux server with Plesk, nginx and Apache. Typically this problem is solved by adding a “Satisfy Any” to the .htaccess in the directory that you want to remove authentication. But this does not work if the path is virtual instead of a physical directory path. Additionally we needed to allow access for a list of IP addresses. We tried an number of different solutions and ended up with the following: Step 1 – The HTTP Basic Auth and IP access controls are configured in the .htaccess file like this:

# basic auth
AuthName "Authorized Only"
AuthType Basic
# password file is maintained from Plesk
AuthUserFile /var/www/vhosts/system/stage.acme.com/pd/d..httpdocs@donotremove
require valid-user

# set an environment variable if there is an AUTH_OVERRIDE header
SetEnvIf AUTH_OVERRIDE ^true AUTH_REQUEST

# set IP controls
order deny,allow
deny from all
allow from 1.1.1.1
allow from 2.2.2.2
# allow request if the environment variable is set
allow from env=AUTH_REQUEST

# require either Basic Auth or IP controls
Satisfy Any

# basic auth

AuthName "Authorized Only"

AuthType Basic

# password file is maintained from Plesk

AuthUserFile /var/www/vhosts/system/stage.acme.com/pd/d..httpdocs@donotremove

require valid-user

# set an environment variable if there is an AUTH_OVERRIDE header

SetEnvIf AUTH_OVERRIDE ^true AUTH_REQUEST

# set IP controls

order deny,allow

deny from all

allow from 1.1.1.1

allow from 2.2.2.2

# allow request if the environment variable is set

allow from env=AUTH_REQUEST

# require either Basic Auth or IP controls

Satisfy Any

Step 2 – In Plesk under:

Subscriptions -> stage.acme.com -> Apache & nginx settings -> Additional nginx directives

1	Subscriptions -> stage.acme.com -> Apache & nginx settings -> Additional nginx directives

Add the following block:

location ~ /excluded/path {
  proxy_set_header AUTH_OVERRIDE true;
  proxy_pass http://x.x.x.x:7080;
  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Accel-Internal /internal-nginx-static-location;
  access_log on;
}