Archive | Apache

Block XSS on Apache or Nginx

By admin on April 16, 2015 in Apache, Nginx

Here are some handy Apache rewrite rules for blocking cross site scripting (XSS) attacks:

RewriteCond %{REQUEST_URI} base64_encode.*\(.*\) [OR]
RewriteCond %{REQUEST_URI} (\<|<).*script.*(\>|>) [NC,OR]
RewriteCond %{REQUEST_URI} (\<|<).*iframe.*(\>|>) [NC,OR]
RewriteCond %{REQUEST_URI} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{REQUEST_URI} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ 404.php [F,L]

RewriteCond %{REQUEST_URI} base64_encode.*$.*$ [OR]

RewriteCond %{REQUEST_URI} (\<|<).*script.*(\>|>) [NC,OR]

RewriteCond %{REQUEST_URI} (\<|<).*iframe.*(\>|>) [NC,OR]

RewriteCond %{REQUEST_URI} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]

RewriteCond %{REQUEST_URI} _REQUEST(=|\[|\%[0-9A-Z]{0,2})

RewriteRule ^(.*)$ 404.php [F,L]

And here are similar rules for Nginx:

set $block_xss 0;
if ($query_string ~ "base64_(en|de)code\(.*\)") {
	set $block_xss 1;
}
if ($request_uri ~ "base64_(en|de)code\(.*\)") {
	set $block_xss 1;
}
if ($query_string ~ "(<|%3C).*script.*(>|%3E)") {
	set $block_xss 1;
}
if ($request_uri ~ "(<|%3C).*script.*(>|%3E)") {
	set $block_xss 1;
}
if ($query_string ~ "(<|%3C).*iframe.*(>|%3E)") {
	set $block_xss 1;
}
if ($request_uri ~ "(<|%3C).*iframe.*(>|%3E)") {
	set $block_xss 1;
}
if ($query_string ~ "GLOBALS(=|\[|\%[0-9A-Z]{0,2})") {
        set $block_xss 1;
}
if ($query_string ~ "_REQUEST(=|\[|\%[0-9A-Z]{0,2})") {
        set $block_xss 1;
}
if ($block_xss = 1) {
	return 403;
}

set $block_xss 0;

if ($query_string ~ "base64_(en|de)code$.*$") {

set $block_xss 1;

}

if ($request_uri ~ "base64_(en|de)code$.*$") {

set $block_xss 1;

}

if ($query_string ~ "(<|%3C).*script.*(>|%3E)") {

set $block_xss 1;

}

if ($request_uri ~ "(<|%3C).*script.*(>|%3E)") {

set $block_xss 1;

}

if ($query_string ~ "(<|%3C).*iframe.*(>|%3E)") {

set $block_xss 1;

}

if ($request_uri ~ "(<|%3C).*iframe.*(>|%3E)") {

set $block_xss 1;

}

if ($query_string ~ "GLOBALS(=|\[|\%[0-9A-Z]{0,2})") {

set $block_xss 1;

}

if ($query_string ~ "_REQUEST(=|\[|\%[0-9A-Z]{0,2})") {

set $block_xss 1;

}

if ($block_xss = 1) {

return 403;

}

We gathered these rules from several sources around the net so they are not original but it’s handy to have them all in one place with both the Apache and Nginx versions.

Apache2 With mod_fcgid On CentOS 6.2

By admin on March 23, 2015 in Apache, PHP

Need mod_fcgid on a CentOS 6.2 or similar server? Check out this great how-to:

https://www.howtoforge.com/how-to-set-up-apache2-with-mod_fcgid-and-php5-on-centos-6.2

I especially like the use of suexec.

This howto worked on the first try! There are not many actual working mod_fcgid howtos!

One issue that I did run into is the default MaxRequestLen is 131768 which is way to low so had to add this line:

FcgidMaxRequestLen 20971520

1	FcgidMaxRequestLen 20971520

to /etc/httpd/conf.d/fcgid.conf.

Disable PHP zlib.output_compression

By admin on January 25, 2015 in Apache, PHP

If you need to disable zlib output compression from the .htaccess file, then just add the following line to the top of the file:

php_flag zlib.output_compression off

1	php_flag zlib.output_compression off

Redirect HTTPS to HTTP

By admin on June 26, 2014 in Apache

If you want to redirect all HTTPS traffic to HTTP then add the following to your .htaccess file:

RewriteCond %{SERVER_PORT} ^443$ [OR]
RewriteCond %{HTTPS} =on
RewriteRule ^(.*)$ http://%{SERVER_NAME}/$1 [R=301,L]

RewriteCond %{SERVER_PORT} ^443$ [OR]

RewriteCond %{HTTPS} =on

RewriteRule ^(.*)$ http://%{SERVER_NAME}/$1 [R=301,L]

Block Access To .git And .svn Folders

By admin on June 26, 2014 in Apache, Nginx

On Nginx add the following to each “server” block:

location ~ /\.git {
  deny all;
}
location ~ /\.svn {
  deny all;
}

location ~ /\.git {

deny all;

}

location ~ /\.svn {

deny all;

}

And the for Apache add the following to the VirtualHost block:

<Directorymatch "^/.*/\.git+/">
  Order deny,allow
  Deny from all
</Directorymatch>
<Files ~ "^\.git">
    Order allow,deny
    Deny from all 
</Files>
<Directorymatch "^/.*/\.svn+/">
  Order deny,allow
  Deny from all
</Directorymatch>
<Files ~ "^\.svn">
    Order allow,deny
    Deny from all
</Files>

Order deny,allow

Deny from all

</Directorymatch>

Order allow,deny

Deny from all

</Files>

Order deny,allow

Deny from all

</Directorymatch>

Order allow,deny

Deny from all

</Files>

← Previous 1 2 3 4 … 18 Next →

Top Nav

Navigation

Archive | Apache

Block XSS on Apache or Nginx

Apache2 With mod_fcgid On CentOS 6.2

Disable PHP zlib.output_compression

Redirect HTTPS to HTTP

Block Access To .git And .svn Folders