Nginx allows file download even with error 403 forbidden
Clash Royale CLAN TAG#URR8PPP
up vote
1
down vote
favorite
I have setup a new centos 7.
I have installed
yum install php72u-fpm
yum install nginx -y
Next I did was to change the root folder in the config file in /etc/nginx/nginx.conf. to /var/www/html.
server_name _;
root /var/www/html;
# Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf;
location /
error_page 404 /404.html;
location = /40x.html
error_page 500 502 503 504 /50x.html;
location = /50x.html
}
Next I created a new folder /var/www/html/test
and I gave nginx the permission chown -R nginx.nginx /var/www/html/test/
So then I got to my http://.../test/ I get 403 forbidden and I check the error log what I get is this.
2018/04/11 14:43:47 [error] 24229#0: *10 directory index of "/var/www/html/test/" is forbidden, client: *.*.*.*, server: _, request: "GET /test/ HTTP/1.1", host: "*.*.*.*"
But to my surprise when I run this command for e.g. http://.../test/page1.php it gets download to my local machine this is definitely a security issue right? How to block this from happening?
centos nginx
asked Apr 11 at 11:57
user8012596
207
add a comment |Â
up vote
1
down vote
favorite
I have setup a new centos 7.
I have installed
yum install php72u-fpm
yum install nginx -y
Next I did was to change the root folder in the config file in /etc/nginx/nginx.conf. to /var/www/html.
server_name _;
root /var/www/html;
# Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf;
location /
error_page 404 /404.html;
location = /40x.html
error_page 500 502 503 504 /50x.html;
location = /50x.html
}
Next I created a new folder /var/www/html/test
and I gave nginx the permission chown -R nginx.nginx /var/www/html/test/
So then I got to my http://.../test/ I get 403 forbidden and I check the error log what I get is this.
2018/04/11 14:43:47 [error] 24229#0: *10 directory index of "/var/www/html/test/" is forbidden, client: *.*.*.*, server: _, request: "GET /test/ HTTP/1.1", host: "*.*.*.*"
But to my surprise when I run this command for e.g. http://.../test/page1.php it gets download to my local machine this is definitely a security issue right? How to block this from happening?
centos nginx
asked Apr 11 at 11:57
user8012596
207
Do you want to protect all of the files in thetestdirectory or all files with a.phpextension?
– Richard Smith
Apr 11 at 14:15
I want to protect all the files just like apache? Can that be done ?
– user8012596
Apr 11 at 16:59
add a comment |Â
up vote
1
down vote
favorite
up vote
1
down vote
favorite
I have setup a new centos 7.
I have installed
yum install php72u-fpm
yum install nginx -y
Next I did was to change the root folder in the config file in /etc/nginx/nginx.conf. to /var/www/html.
server_name _;
root /var/www/html;
# Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf;
location /
error_page 404 /404.html;
location = /40x.html
error_page 500 502 503 504 /50x.html;
location = /50x.html
}
Next I created a new folder /var/www/html/test
and I gave nginx the permission chown -R nginx.nginx /var/www/html/test/
So then I got to my http://.../test/ I get 403 forbidden and I check the error log what I get is this.
2018/04/11 14:43:47 [error] 24229#0: *10 directory index of "/var/www/html/test/" is forbidden, client: *.*.*.*, server: _, request: "GET /test/ HTTP/1.1", host: "*.*.*.*"
But to my surprise when I run this command for e.g. http://.../test/page1.php it gets download to my local machine this is definitely a security issue right? How to block this from happening?
centos nginx
asked Apr 11 at 11:57
user8012596
207
I have setup a new centos 7.
I have installed
yum install php72u-fpm
yum install nginx -y
Next I did was to change the root folder in the config file in /etc/nginx/nginx.conf. to /var/www/html.
server_name _;
root /var/www/html;
# Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf;
location /
error_page 404 /404.html;
location = /40x.html
error_page 500 502 503 504 /50x.html;
location = /50x.html
}
Next I created a new folder /var/www/html/test
and I gave nginx the permission chown -R nginx.nginx /var/www/html/test/
So then I got to my http://.../test/ I get 403 forbidden and I check the error log what I get is this.
2018/04/11 14:43:47 [error] 24229#0: *10 directory index of "/var/www/html/test/" is forbidden, client: *.*.*.*, server: _, request: "GET /test/ HTTP/1.1", host: "*.*.*.*"
But to my surprise when I run this command for e.g. http://.../test/page1.php it gets download to my local machine this is definitely a security issue right? How to block this from happening?
centos nginx
asked Apr 11 at 11:57
user8012596
207
asked Apr 11 at 11:57
user8012596
207
asked Apr 11 at 11:57
user8012596
207
asked Apr 11 at 11:57
user8012596
207
207
Do you want to protect all of the files in thetestdirectory or all files with a.phpextension?
– Richard Smith
Apr 11 at 14:15
I want to protect all the files just like apache? Can that be done ?
– user8012596
Apr 11 at 16:59
add a comment |Â
Do you want to protect all of the files in thetestdirectory or all files with a.phpextension?
– Richard Smith
Apr 11 at 14:15
I want to protect all the files just like apache? Can that be done ?
– user8012596
Apr 11 at 16:59
Do you want to protect all of the files in the
test directory or all files with a .php extension?– Richard Smith
Apr 11 at 14:15
Do you want to protect all of the files in the
test directory or all files with a .php extension?– Richard Smith
Apr 11 at 14:15
I want to protect all the files just like apache? Can that be done ?
– user8012596
Apr 11 at 16:59
I want to protect all the files just like apache? Can that be done ?
– user8012596
Apr 11 at 16:59
add a comment |Â
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f436992%2fnginx-allows-file-download-even-with-error-403-forbidden%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Do you want to protect all of the files in the
testdirectory or all files with a.phpextension?– Richard Smith
Apr 11 at 14:15
I want to protect all the files just like apache? Can that be done ?
– user8012596
Apr 11 at 16:59