View source for NginX

'''NginX HTTP Server''' nginx [engine x] is a HTTP and reverse proxy server, as well as a mail proxy server written by Igor Sysoev. It has been running for more than five years on many heavily loaded Russian sites including Rambler (RamblerMedia.com). According to [http://news.netcraft.com/ Netcraft], Nginx served or proxied 4.70% busiest sites in April 2010 and 10.46% in June 2012.
{{Source|From nginx.org}}

{{Logging_Outputs}}

<div style="padding: 1em;border: 1px dashed #2f6fab;color: black;background-color: #f9f9f9;line-height: 1.1em;">
* 2012/04/07 08:27:31 [error] 13409#0: *373855 "/var/www/index.html" is not found (2: No such file or directory), client: 123.123.123.123, server: www.test.com, request: "GET /index.html HTTP/1.0", host: "www.test.com", referrer: "http://www.test2.com"
* 2011/07/16 10:27:48 [error] 5508#0: *223811 open() "/var/www/test.jpg" failed (2: No such file or directory), client: 123.123.123.123, server: www.test.com, request: "GET /test.jpg HTTP/1.1", host: "www.test.com", referrer: "http://www.test2.com"
* 2011/07/16 12:00:37 [error] 5508#0: *234170 user "test" was not found in "/var/www/.htpasswd", client: 123.123.123.123, server: www.test.com, request: "GET / HTTP/1.1", host: "www.test.com"
* 2011/07/16 12:01:15 [error] 5508#0: *234170 user "test": password mismatch, client: 123.123.123.123, server: www.test.com, request: "GET / HTTP/1.1", host: "www.test.com"
</div>


{{Failregex}}

Authentication failure

<div style="padding: 1em;border: 1px dashed #2f6fab;color: black;background-color: #f9f9f9;line-height: 1.1em;">
* user .* password mismatch, client: <HOST>
</div>

User not found

<div style="padding: 1em;border: 1px dashed #2f6fab;color: black;background-color: #f9f9f9;line-height: 1.1em;">
* user .* was not found in .*, client: <HOST>
</div>

apache-nohome.conf in Debian (This file isn't useful, just check for a machting .*/~.* with the file not found / failed message regex)

<div style="padding: 1em;border: 1px dashed #2f6fab;color: black;background-color: #f9f9f9;line-height: 1.1em;">
* .*/~.* (is not found|failed) \(2: No such file or directory\), client: <HOST>
</div>

apache-badbots.conf in Debian

<div style="padding: 1em;border: 1px dashed #2f6fab;color: black;background-color: #f9f9f9;line-height: 1.1em;">
* This file is the only apache config file which can be used without a modification.
</div>

File not found / failed messages (Here you can use apache_noscript.conf as described here:

[[Apache]]

and use

<div style="padding: 1em;border: 1px dashed #2f6fab;color: black;background-color: #f9f9f9;line-height: 1.1em;">
* .*/(foo|bar|xyz)" (is not found|failed) \(2: No such file or directory\), client: <HOST>
</div>

instead of:

<div style="padding: 1em;border: 1px dashed #2f6fab;color: black;background-color: #f9f9f9;line-height: 1.1em;">
* [[]client <HOST>[]] (File does not exist|script not found or unable to stat): .*/(foo|bar|xyz)
</div>

==PHP==

There are many ways to include php into nginx, the most common way is to use spawncgi from lighttpd or php-fpm. If NginX is Configures properly [http://wiki.nginx.org/Pitfalls#Passing_Uncontrolled_Requests_to_PHP] it doesn't forward not found .php files to the normal error.log and you can use the above file not found / failed regexes to make the checks.
Additionaly, Suhosin can be installed and the Rule from [[Fail2ban:Community_Portal#suhosin]] works without a problem.

[[Category: HTTP]]