일반적인 PHP 사이트 (그누보드 등)
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 | server { listen 80; server_name samplesite.com www.samplesite.com anothersite.net; root /home/myuser1/www ; #set same size as post_max_size(php.ini or php_admin_value). client_max_body_size 10M; access_log /var/log/nginx/samplesite .com.access.log main; error_log /var/log/nginx/samplesite .com.error.log warn; location / { index index.php index.html; } # Allow Lets Encrypt Domain Validation Program location ^~ /.well-known /acme-challenge/ { allow all; } # Block dot file (.htaccess .htpasswd .svn .git .env and so on.) location ~ /\. { deny all; } # Block (log file, binary, certificate, shell script, sql dump file) access. location ~* \.(log|binary|pem|enc|crt|conf|cnf|sql|sh|key)$ { deny all; } # Block access location ~* (composer\.json|composer\.lock|composer\.phar|contributing\.md|license\.txt|readme\.rst|readme\.md|readme\.txt|copyright|artisan|gulpfile\.js|package\.json|phpunit\.xml)$ { deny all; } location = /favicon .ico { log_not_found off; access_log off; } location = /robots .txt { log_not_found off; access_log off; } # Block .php file inside upload folder. uploads(wp), files(drupal), data(gnuboard). location ~* /(?:uploads|default /files |data)/.*\.php$ { deny all; } # Add PHP handler location ~ [^/]\.php(/|$) { fastcgi_split_path_info ^(.+?\.php)(/.*)$; if (!-f $document_root$fastcgi_script_name) { return 404; } fastcgi_pass unix: /var/run/php-fpm/myuser1 .sock; fastcgi_index index.php; fastcgi_buffers 64 4k; # default 8 4k include fastcgi_params; } } |
짧은 주소 사이트(워드프레스, 드루팔, CI, Laravel)에서는 try_files 구문을 통해 응답을 index.php 파일로 보내도록 설정합니다.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 | server { listen 80; server_name samplesite.com www.samplesite.com anothersite.net; root /home/myuser1/www ; #set same size as post_max_size(php.ini or php_admin_value). client_max_body_size 10M; access_log /var/log/nginx/samplesite .com.access.log main; error_log /var/log/nginx/samplesite .com.error.log warn; location / { index index.php index.html; try_files $uri $uri/ /index .php?$args; } # Allow Lets Encrypt Domain Validation Program location ^~ /.well-known /acme-challenge/ { allow all; } # Block dot file (.htaccess .htpasswd .svn .git .env and so on.) location ~ /\. { deny all; } # Block (log file, binary, certificate, shell script, sql dump file) access. location ~* \.(log|binary|pem|enc|crt|conf|cnf|sql|sh|key)$ { deny all; } # Block access location ~* (composer\.json|composer\.lock|composer\.phar|contributing\.md|license\.txt|readme\.rst|readme\.md|readme\.txt|copyright|artisan|gulpfile\.js|package\.json|phpunit\.xml)$ { deny all; } location = /favicon .ico { log_not_found off; access_log off; } location = /robots .txt { log_not_found off; access_log off; } # Block .php file inside upload folder. uploads(wp), files(drupal), data(gnuboard). location ~* /(?:uploads|default /files |data)/.*\.php$ { deny all; } # Add PHP handler location ~ [^/]\.php(/|$) { fastcgi_split_path_info ^(.+?\.php)(/.*)$; if (!-f $document_root$fastcgi_script_name) { return 404; } fastcgi_pass unix: /var/run/php-fpm/myuser1 .sock; fastcgi_index index.php; fastcgi_buffers 64 4k; # default 8 4k include fastcgi_params; } } |
https 관련 구문을 설정합니다.
인증서 발급업체에서 인증서 파일을 발급받아 준비해야 합니다. 또는
https://blog.lael.be/post/5107 글을 통해 직접 인증서 파일을 발급할 수 있습니다.
다음 명령어로 dhparam.pem 파일을 먼저 생성해야 합니다. (서버 내에 1회만 실행하면 됨. 중복실행해도 문제없음)
1 | openssl dhparam -out /etc/ssl/certs/dhparam .pem 2048 |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 | server { listen 80; server_name samplesite.com www.samplesite.com anothersite.net; return 301 https: // $server_name$request_uri; } server { listen 443 ssl http2; server_name samplesite.com www.samplesite.com anothersite.net; root /home/myuser1/www ; #set same size as post_max_size(php.ini or php_admin_value). client_max_body_size 10M; ssl_certificate /home/myuser1/ssl/mergedssl .crt; ssl_certificate_key /home/myuser1/ssl/ssl .dec.key; ssl_dhparam "/etc/ssl/certs/dhparam.pem" ; # Enable HSTS. This forces SSL on clients that respect it, most modern browsers. The includeSubDomains flag is optional. add_header Strict-Transport-Security "max-age=31536000" ; # Set caches, protocols, and accepted ciphers. This config will merit an A+ SSL Labs score. ssl_session_cache shared:SSL:20m; ssl_session_timeout 10m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_ciphers 'ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5' ; access_log /var/log/nginx/samplesite .com.access.log main; error_log /var/log/nginx/samplesite .com.error.log warn; location / { index index.php index.html; try_files $uri $uri/ /index .php?$args; } # Allow Lets Encrypt Domain Validation Program location ^~ /.well-known /acme-challenge/ { allow all; } # Block dot file (.htaccess .htpasswd .svn .git .env and so on.) location ~ /\. { deny all; } # Block (log file, binary, certificate, shell script, sql dump file) access. location ~* \.(log|binary|pem|enc|crt|conf|cnf|sql|sh|key)$ { deny all; } # Block access location ~* (composer\.json|composer\.lock|composer\.phar|contributing\.md|license\.txt|readme\.rst|readme\.md|readme\.txt|copyright|artisan|gulpfile\.js|package\.json|phpunit\.xml)$ { deny all; } location = /favicon .ico { log_not_found off; access_log off; } location = /robots .txt { log_not_found off; access_log off; } # Block .php file inside upload folder. uploads(wp), files(drupal), data(gnuboard). location ~* /(?:uploads|default /files |data)/.*\.php$ { deny all; } # Add PHP handler location ~ [^/]\.php(/|$) { fastcgi_split_path_info ^(.+?\.php)(/.*)$; if (!-f $document_root$fastcgi_script_name) { return 404; } fastcgi_pass unix: /var/run/php-fpm/myuser1 .sock; fastcgi_index index.php; fastcgi_buffers 64 4k; # default 8 4k include fastcgi_params; } } |
https 관련 구문을 설정합니다.
인증서 발급업체에서 인증서 파일을 발급받아 준비해야 합니다. 또는
https://blog.lael.be/post/5107 글을 통해 직접 인증서 파일을 발급할 수 있습니다.
다음 명령어로 dhparam.pem 파일을 먼저 생성해야 합니다. (서버 내에 1회만 실행하면 됨. 중복실행해도 문제없음)
1 | openssl dhparam -out /etc/ssl/certs/dhparam .pem 2048 |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 | server { listen 80; server_name samplesite.com www.samplesite.com anothersite.net; return 301 https: // $server_name$request_uri; } server { listen 443 ssl http2; server_name samplesite.com www.samplesite.com anothersite.net; root /home/myuser1/www ; #set same size as post_max_size(php.ini or php_admin_value). client_max_body_size 10M; ssl_certificate /home/myuser1/ssl/mergedssl .crt; ssl_certificate_key /home/myuser1/ssl/ssl .dec.key; ssl_dhparam "/etc/ssl/certs/dhparam.pem" ; # Enable HSTS. This forces SSL on clients that respect it, most modern browsers. The includeSubDomains flag is optional. add_header Strict-Transport-Security "max-age=31536000" ; # Set caches, protocols, and accepted ciphers. This config will merit an A+ SSL Labs score. ssl_session_cache shared:SSL:20m; ssl_session_timeout 10m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_ciphers 'ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5' ; access_log /var/log/nginx/samplesite .com.access.log main; error_log /var/log/nginx/samplesite .com.error.log warn; location / { index index.php index.html; } # Allow Lets Encrypt Domain Validation Program location ^~ /.well-known /acme-challenge/ { allow all; } # Block dot file (.htaccess .htpasswd .svn .git .env and so on.) location ~ /\. { deny all; } # Block (log file, binary, certificate, shell script, sql dump file) access. location ~* \.(log|binary|pem|enc|crt|conf|cnf|sql|sh|key)$ { deny all; } # Block access location ~* (composer\.json|composer\.lock|composer\.phar|contributing\.md|license\.txt|readme\.rst|readme\.md|readme\.txt|copyright|artisan|gulpfile\.js|package\.json|phpunit\.xml)$ { deny all; } location = /favicon .ico { log_not_found off; access_log off; } location = /robots .txt { log_not_found off; access_log off; } # Block .php file inside upload folder. uploads(wp), files(drupal), data(gnuboard). location ~* /(?:uploads|default /files |data)/.*\.php$ { deny all; } # Add PHP handler location ~ [^/]\.php(/|$) { fastcgi_split_path_info ^(.+?\.php)(/.*)$; if (!-f $document_root$fastcgi_script_name) { return 404; } fastcgi_pass unix: /var/run/php-fpm/myuser1 .sock; fastcgi_index index.php; fastcgi_buffers 64 4k; # default 8 4k include fastcgi_params; } } |
http와 https 모두 사용합니다. 어쩔 수 없는 상황이 아니라면, https 하나만 사용하는 것이 좋습니다.
인증서 발급업체에서 인증서 파일을 발급받아 준비해야 합니다. 또는
https://blog.lael.be/post/5107 글을 통해 직접 인증서 파일을 발급할 수 있습니다.
다음 명령어로 dhparam.pem 파일을 먼저 생성해야 합니다. (서버 내에 1회만 실행하면 됨. 중복실행해도 문제없음)
1 | openssl dhparam -out /etc/ssl/certs/dhparam .pem 2048 |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 | server { listen 80; server_name samplesite.com www.samplesite.com anothersite.net; root /home/myuser1/www ; #set same size as post_max_size(php.ini or php_admin_value). client_max_body_size 10M; access_log /var/log/nginx/samplesite .com.access.log main; error_log /var/log/nginx/samplesite .com.error.log warn; location / { index index.php index.html; } # Allow Lets Encrypt Domain Validation Program location ^~ /.well-known /acme-challenge/ { allow all; } # Block dot file (.htaccess .htpasswd .svn .git .env and so on.) location ~ /\. { deny all; } # Block (log file, binary, certificate, shell script, sql dump file) access. location ~* \.(log|binary|pem|enc|crt|conf|cnf|sql|sh|key)$ { deny all; } # Block access location ~* (composer\.json|composer\.lock|composer\.phar|contributing\.md|license\.txt|readme\.rst|readme\.md|readme\.txt|copyright|artisan|gulpfile\.js|package\.json|phpunit\.xml)$ { deny all; } location = /favicon .ico { log_not_found off; access_log off; } location = /robots .txt { log_not_found off; access_log off; } # Block .php file inside upload folder. uploads(wp), files(drupal), data(gnuboard). location ~* /(?:uploads|default /files |data)/.*\.php$ { deny all; } # Add PHP handler location ~ [^/]\.php(/|$) { fastcgi_split_path_info ^(.+?\.php)(/.*)$; if (!-f $document_root$fastcgi_script_name) { return 404; } fastcgi_pass unix: /var/run/php-fpm/myuser1 .sock; fastcgi_index index.php; fastcgi_buffers 64 4k; # default 8 4k include fastcgi_params; } } server { listen 443 ssl http2; server_name samplesite.com www.samplesite.com anothersite.net; root /home/myuser1/www ; #set same size as post_max_size(php.ini or php_admin_value). client_max_body_size 10M; ssl_certificate /home/myuser1/ssl/mergedssl .crt; ssl_certificate_key /home/myuser1/ssl/ssl .dec.key; ssl_dhparam "/etc/ssl/certs/dhparam.pem" ; # Disable HSTS. add_header Strict-Transport-Security "max-age=0" ; # Set caches, protocols, and accepted ciphers. This config will merit an A+ SSL Labs score. ssl_session_cache shared:SSL:20m; ssl_session_timeout 10m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_ciphers 'ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5' ; access_log /var/log/nginx/samplesite .com.access.log main; error_log /var/log/nginx/samplesite .com.error.log warn; location / { index index.php index.html; } # Allow Lets Encrypt Domain Validation Program location ^~ /.well-known /acme-challenge/ { allow all; } # Block dot file (.htaccess .htpasswd .svn .git .env and so on.) location ~ /\. { deny all; } # Block (log file, binary, certificate, shell script, sql dump file) access. location ~* \.(log|binary|pem|enc|crt|conf|cnf|sql|sh|key)$ { deny all; } # Block access location ~* (composer\.json|composer\.lock|composer\.phar|contributing\.md|license\.txt|readme\.rst|readme\.md|readme\.txt|copyright|artisan|gulpfile\.js|package\.json|phpunit\.xml)$ { deny all; } location = /favicon .ico { log_not_found off; access_log off; } location = /robots .txt { log_not_found off; access_log off; } # Block .php file inside upload folder. uploads(wp), files(drupal), data(gnuboard). location ~* /(?:uploads|default /files |data)/.*\.php$ { deny all; } # Add PHP handler location ~ [^/]\.php(/|$) { fastcgi_split_path_info ^(.+?\.php)(/.*)$; if (!-f $document_root$fastcgi_script_name) { return 404; } fastcgi_pass unix: /var/run/php-fpm/myuser1 .sock; fastcgi_index index.php; fastcgi_buffers 64 4k; # default 8 4k include fastcgi_params; } } |