Nginx Server For Hosting Files Ubuntu 22.04
| Please Select a Licence from the LICENCE_HEADERS page |
And place at top of your page |
If no Licence is Selected/Appended, Default will be CC0 Default Licence IF there is no Licence placed below this notice!
When you edit this page, you agree to release your contribution under the CC0 Licence LICENCE:
More information about the cc0 licence can be found here: You can copy, modify, distribute and perform the work, even for commercial purposes, all without asking permission. Licence: Statement of Purpose The laws of most jurisdictions throughout the world automatically confer exclusive Copyright and Related Rights (defined below) upon the creator and subsequent owner(s) (each and all, an "owner") of an original work of authorship and/or a database (each, a "Work"). Certain owners wish to permanently relinquish those rights to a Work for the purpose of contributing to a commons of creative, cultural and scientific works ("Commons") that the public can reliably and without fear of later claims of infringement build upon, modify, incorporate in other works, reuse and redistribute as freely as possible in any form whatsoever and for any purposes, including without limitation commercial purposes. These owners may contribute to the Commons to promote the ideal of a free culture and the further production of creative, cultural and scientific works, or to gain reputation or greater distribution for their Work in part through the use and efforts of others. For these and/or other purposes and motivations, and without any expectation of additional consideration or compensation, the person associating CC0 with a Work (the "Affirmer"), to the extent that he or she is an owner of Copyright and Related Rights in the Work, voluntarily elects to apply CC0 to the Work and publicly distribute the Work under its terms, with knowledge of his or her Copyright and Related Rights in the Work and the meaning and intended legal effect of CC0 on those rights. 1. Copyright and Related Rights. A Work made available under CC0 may be protected by copyright and related or neighboring rights ("Copyright and Related Rights"). Copyright and Related Rights include, but are not limited to, the following: the right to reproduce, adapt, distribute, perform, display, communicate, and translate a Work; moral rights retained by the original author(s) and/or performer(s); publicity and privacy rights pertaining to a person's image or likeness depicted in a Work; rights protecting against unfair competition in regards to a Work, subject to the limitations in paragraph 4(a), below; rights protecting the extraction, dissemination, use and reuse of data in a Work; database rights (such as those arising under Directive 96/9/EC of the European Parliament and of the Council of 11 March 1996 on the legal protection of databases, and under any national implementation thereof, including any amended or successor version of such directive); and other similar, equivalent or corresponding rights throughout the world based on applicable law or treaty, and any national implementations thereof. 2. Waiver. To the greatest extent permitted by, but not in contravention of, applicable law, Affirmer hereby overtly, fully, permanently, irrevocably and unconditionally waives, abandons, and surrenders all of Affirmer's Copyright and Related Rights and associated claims and causes of action, whether now known or unknown (including existing as well as future claims and causes of action), in the Work (i) in all territories worldwide, (ii) for the maximum duration provided by applicable law or treaty (including future time extensions), (iii) in any current or future medium and for any number of copies, and (iv) for any purpose whatsoever, including without limitation commercial, advertising or promotional purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each member of the public at large and to the detriment of Affirmer's heirs and successors, fully intending that such Waiver shall not be subject to revocation, rescission, cancellation, termination, or any other legal or equitable action to disrupt the quiet enjoyment of the Work by the public as contemplated by Affirmer's express Statement of Purpose. 3. Public License Fallback. Should any part of the Waiver for any reason be judged legally invalid or ineffective under applicable law, then the Waiver shall be preserved to the maximum extent permitted taking into account Affirmer's express Statement of Purpose. In addition, to the extent the Waiver is so judged Affirmer hereby grants to each affected person a royalty-free, non transferable, non sublicensable, non exclusive, irrevocable and unconditional license to exercise Affirmer's Copyright and Related Rights in the Work (i) in all territories worldwide, (ii) for the maximum duration provided by applicable law or treaty (including future time extensions), (iii) in any current or future medium and for any number of copies, and (iv) for any purpose whatsoever, including without limitation commercial, advertising or promotional purposes (the "License"). The License shall be deemed effective as of the date CC0 was applied by Affirmer to the Work. Should any part of the License for any reason be judged legally invalid or ineffective under applicable law, such partial invalidity or ineffectiveness shall not invalidate the remainder of the License, and in such case Affirmer hereby affirms that he or she will not (i) exercise any of his or her remaining Copyright and Related Rights in the Work or (ii) assert any associated claims and causes of action with respect to the Work, in either case contrary to Affirmer's express Statement of Purpose. 4. Limitations and Disclaimers. No trademark or patent rights held by Affirmer are waived, abandoned, surrendered, licensed or otherwise affected by this document. Affirmer offers the Work as-is and makes no representations or warranties of any kind concerning the Work, express, implied, statutory or otherwise, including without limitation warranties of title, merchantability, fitness for a particular purpose, non infringement, or the absence of latent or other defects, accuracy, or the present or absence of errors, whether or not discoverable, all to the greatest extent permissible under applicable law. Affirmer disclaims responsibility for clearing rights of other persons that may apply to the Work or any use thereof, including without limitation any person's Copyright and Related Rights in the Work. Further, Affirmer disclaims responsibility for obtaining any necessary consents, permissions or other rights required for any use of the Work. Affirmer understands and acknowledges that Creative Commons is not a party to this document and has no duty or obligation with respect to this CC0 or use of the Work. |
With DNS - cert by LetsEncrypt
No DNS Using IP and Self Signed Certs for https
Spin up a Server
Using Vultr i am going to deploy a Ubuntu 20.04 Server.
$5 a month, 1 cpu, 1024MB ram, 25GB ssd, 1000GB Bandwidth.
I have been given the IP:192.248.155.201
DNS
make a A RECORD for subdomain server IP address
| Type | Host | Ip address | TTL |
| A record | xml | 192.248.155.201 | auto |
Enable Basic FireWall
ufw allow 22/tcp
ufw allow 443/tcp
ufw allow 80/tcp
ufw enable
Enable Auto Updates
Setup Basic Auto Updates for your Server so you don't have to keep logging into server to update
Install NGINX
apt install nginx -y
You should now be able to see the Welcome to nginx! site on your subdomain (or just use server ip address).
Only http will work as we have not yet setup are https
Default NGINX Before Certbot - Placed here just for notes:
cat /etc/nginx/sites-available/default
##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# https://www.nginx.com/resources/wiki/start/
# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
# https://wiki.debian.org/Nginx/DirectoryStructure
#
# In most cases, administrators will remove this file from sites-enabled/ and
# leave it as reference inside of sites-available where it will continue to be
# updated by the nginx packaging team.
#
# This file will automatically load configuration files provided by other
# applications, such as Drupal or Wordpress. These applications will be made
# available underneath a path with that package name, such as /drupal8.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##
# Default server configuration
#
server {
listen 80 default_server;
listen [::]:80 default_server;
# SSL configuration
#
# listen 443 ssl default_server;
# listen [::]:443 ssl default_server;
#
# Note: You should disable gzip for SSL traffic.
# See: https://bugs.debian.org/773332
#
# Read up on ssl_ciphers to ensure a secure configuration.
# See: https://bugs.debian.org/765782
#
# Self signed certs generated by the ssl-cert package
# Don't use them in a production server!
#
# include snippets/snakeoil.conf;
root /var/www/html;
# Add index.php to the list if you are using PHP
index index.html index.htm index.nginx-debian.html;
server_name _;
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
}
# pass PHP scripts to FastCGI server
#
#location ~ \.php$ {
# include snippets/fastcgi-php.conf;
#
# # With php-fpm (or other unix sockets):
# fastcgi_pass unix:/run/php/php7.4-fpm.sock;
# # With php-cgi (or other tcp sockets):
# fastcgi_pass 127.0.0.1:9000;
#}
# deny access to .htaccess files, if Apache's document root
# concurs with nginx's one
#
#location ~ /\.ht {
# deny all;
#}
}
# Virtual Host configuration for example.com
#
# You can move that to a different file under sites-available/ and symlink that
# to sites-enabled/ to enable it.
#
#server {
# listen 80;
# listen [::]:80;
#
# server_name example.com;
#
# root /var/www/example.com;
# index index.html;
#
# location / {
# try_files $uri $uri/ =404;
# }
#}
LetsEncrypt
snap install certbot --classic
certbot --nginx -d xml.completenoobs.com
You should now be able to view the Welcome to nginx! page with https
Setup NGINX
CertBot did the work for us :) Good Bot.
The nginx default site should look like this:
cat /etc/nginx/sites-available/default
##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# https://www.nginx.com/resources/wiki/start/
# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
# https://wiki.debian.org/Nginx/DirectoryStructure
#
# In most cases, administrators will remove this file from sites-enabled/ and
# leave it as reference inside of sites-available where it will continue to be
# updated by the nginx packaging team.
#
# This file will automatically load configuration files provided by other
# applications, such as Drupal or Wordpress. These applications will be made
# available underneath a path with that package name, such as /drupal8.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##
# Default server configuration
#
server {
listen 80 default_server;
listen [::]:80 default_server;
# SSL configuration
#
# listen 443 ssl default_server;
# listen [::]:443 ssl default_server;
#
# Note: You should disable gzip for SSL traffic.
# See: https://bugs.debian.org/773332
#
# Read up on ssl_ciphers to ensure a secure configuration.
# See: https://bugs.debian.org/765782
#
# Self signed certs generated by the ssl-cert package
# Don't use them in a production server!
#
# include snippets/snakeoil.conf;
root /var/www/html;
# Add index.php to the list if you are using PHP
index index.html index.htm index.nginx-debian.html;
server_name _;
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
}
# pass PHP scripts to FastCGI server
#
#location ~ \.php$ {
# include snippets/fastcgi-php.conf;
#
# # With php-fpm (or other unix sockets):
# fastcgi_pass unix:/run/php/php7.4-fpm.sock;
# # With php-cgi (or other tcp sockets):
# fastcgi_pass 127.0.0.1:9000;
#}
# deny access to .htaccess files, if Apache's document root
# concurs with nginx's one
#
#location ~ /\.ht {
# deny all;
#}
}
# Virtual Host configuration for example.com
#
# You can move that to a different file under sites-available/ and symlink that
# to sites-enabled/ to enable it.
#
#server {
# listen 80;
# listen [::]:80;
#
# server_name example.com;
#
# root /var/www/example.com;
# index index.html;
#
# location / {
# try_files $uri $uri/ =404;
# }
#}
server {
# SSL configuration
#
# listen 443 ssl default_server;
# listen [::]:443 ssl default_server;
#
# Note: You should disable gzip for SSL traffic.
# See: https://bugs.debian.org/773332
#
# Read up on ssl_ciphers to ensure a secure configuration.
# See: https://bugs.debian.org/765782
#
# Self signed certs generated by the ssl-cert package
# Don't use them in a production server!
#
# include snippets/snakeoil.conf;
root /var/www/html;
# Add index.php to the list if you are using PHP
index index.html index.htm index.nginx-debian.html;
server_name xml.completenoobs.com; # managed by Certbot
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
}
# pass PHP scripts to FastCGI server
#
#location ~ \.php$ {
# include snippets/fastcgi-php.conf;
#
# # With php-fpm (or other unix sockets):
# fastcgi_pass unix:/run/php/php7.4-fpm.sock;
# # With php-cgi (or other tcp sockets):
# fastcgi_pass 127.0.0.1:9000;
#}
# deny access to .htaccess files, if Apache's document root
# concurs with nginx's one
#
#location ~ /\.ht {
# deny all;
#}
listen [::]:443 ssl ipv6only=on; # managed by Certbot
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/xml.completenoobs.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/xml.completenoobs.com/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
if ($host = xml.completenoobs.com) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 80 ;
listen [::]:80 ;
server_name xml.completenoobs.com;
return 404; # managed by Certbot
}
We just need to add one line autoindex on;in the location { }
$EDITOR /etc/nginx/sites-available/default
/etc/nginx/sites-available/default After appending autoindex on;:
##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# https://www.nginx.com/resources/wiki/start/
# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
# https://wiki.debian.org/Nginx/DirectoryStructure
#
# In most cases, administrators will remove this file from sites-enabled/ and
# leave it as reference inside of sites-available where it will continue to be
# updated by the nginx packaging team.
#
# This file will automatically load configuration files provided by other
# applications, such as Drupal or Wordpress. These applications will be made
# available underneath a path with that package name, such as /drupal8.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##
# Default server configuration
#
server {
listen 80 default_server;
listen [::]:80 default_server;
# SSL configuration
#
# listen 443 ssl default_server;
# listen [::]:443 ssl default_server;
#
# Note: You should disable gzip for SSL traffic.
# See: https://bugs.debian.org/773332
#
# Read up on ssl_ciphers to ensure a secure configuration.
# See: https://bugs.debian.org/765782
#
# Self signed certs generated by the ssl-cert package
# Don't use them in a production server!
#
# include snippets/snakeoil.conf;
root /var/www/html;
# Add index.php to the list if you are using PHP
index index.html index.htm index.nginx-debian.html;
server_name _;
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
}
# pass PHP scripts to FastCGI server
#
#location ~ \.php$ {
# include snippets/fastcgi-php.conf;
#
# # With php-fpm (or other unix sockets):
# fastcgi_pass unix:/run/php/php7.4-fpm.sock;
# # With php-cgi (or other tcp sockets):
# fastcgi_pass 127.0.0.1:9000;
#}
# deny access to .htaccess files, if Apache's document root
# concurs with nginx's one
#
#location ~ /\.ht {
# deny all;
#}
}
# Virtual Host configuration for example.com
#
# You can move that to a different file under sites-available/ and symlink that
# to sites-enabled/ to enable it.
#
#server {
# listen 80;
# listen [::]:80;
#
# server_name example.com;
#
# root /var/www/example.com;
# index index.html;
#
# location / {
# try_files $uri $uri/ =404;
# }
#}
server {
# SSL configuration
#
# listen 443 ssl default_server;
# listen [::]:443 ssl default_server;
#
# Note: You should disable gzip for SSL traffic.
# See: https://bugs.debian.org/773332
#
# Read up on ssl_ciphers to ensure a secure configuration.
# See: https://bugs.debian.org/765782
#
# Self signed certs generated by the ssl-cert package
# Don't use them in a production server!
#
# include snippets/snakeoil.conf;
root /var/www/html;
# Add index.php to the list if you are using PHP
index index.html index.htm index.nginx-debian.html;
server_name xml.completenoobs.com; # managed by Certbot
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
# To allow browsing of directory
autoindex on;
}
# pass PHP scripts to FastCGI server
#
#location ~ \.php$ {
# include snippets/fastcgi-php.conf;
#
# # With php-fpm (or other unix sockets):
# fastcgi_pass unix:/run/php/php7.4-fpm.sock;
# # With php-cgi (or other tcp sockets):
# fastcgi_pass 127.0.0.1:9000;
#}
# deny access to .htaccess files, if Apache's document root
# concurs with nginx's one
#
#location ~ /\.ht {
# deny all;
#}
listen [::]:443 ssl ipv6only=on; # managed by Certbot
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/xml.completenoobs.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/xml.completenoobs.com/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
if ($host = xml.completenoobs.com) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 80 ;
listen [::]:80 ;
server_name xml.completenoobs.com;
return 404; # managed by Certbot
}
Same File with Comments removed for easier read:
# Default server configuration
#
server {
listen 80 default_server;
listen [::]:80 default_server;
root /var/www/html;
# Add index.php to the list if you are using PHP
index index.html index.htm index.nginx-debian.html;
server_name _;
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
}
}
server {
root /var/www/html;
# Add index.php to the list if you are using PHP
index index.html index.htm index.nginx-debian.html;
server_name xml.completenoobs.com; # managed by Certbot
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
# To allow browsing of directory
autoindex on;
}
listen [::]:443 ssl ipv6only=on; # managed by Certbot
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/xml.completenoobs.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/xml.completenoobs.com/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
if ($host = xml.completenoobs.com) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 80 ;
listen [::]:80 ;
server_name xml.completenoobs.com;
return 404; # managed by Certbot
}
More Info
autoindex on; directive:
The autoindex on; directive in an Nginx configuration file enables directory listing for the specified location.
In other words, if a user requests a URL that corresponds to a directory (rather than a specific file), and autoindex on; is specified for that location in the Nginx configuration file, then Nginx will generate a directory listing page that shows the contents of that directory.
This can be useful for making files available for download or for providing an easy way to browse the contents of a directory. However, it can also be a security risk if sensitive files are inadvertently made available for download or if a user gains access to a directory listing page that they should not be able to access.
To mitigate this risk, it's important to ensure that the autoindex on; directive is only used when necessary and is not enabled for sensitive directories or files. It's also a good idea to customize the appearance of the directory listing page to make it clear what files are available and to restrict access to the directory listing page using Nginx authentication or other security measures.
Nginx Config File:
# Default server configuration
#
server {
listen 80 default_server;
listen [::]:80 default_server;
######^^^
These two lines specify that the server block is listening on port 80 (the default HTTP port) for IPv4 and IPv6 connections. The default_server parameter indicates that this block will be used as the default server block for any incoming connections that do not match any other server blocks.
#################################################
root /var/www/html;
######^^
This line sets the root directory for the server block. This is the directory where Nginx will look for files to serve in response to incoming requests.
##########################################
# Add index.php to the list if you are using PHP
index index.html index.htm index.nginx-debian.html;
##########^^
This line specifies the order in which Nginx should look for index files in the root directory when serving requests. In this case, Nginx will first look for index.html, then index.htm, and then index.nginx-debian.html.
##########################################################
server_name _;
#######^^
This line specifies the server name for the block. The underscore _ indicates a catch-all server name, meaning that this block will handle any requests that do not match a server name defined in another server block.
#######################################################
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
###############^^
This block specifies the location directive for requests that match the root directory of the server block. The try_files directive specifies that Nginx should first try to serve the request as a file, then as a directory, and then return a 404 error if the file or directory cannot be found.
######################################################
}
}
server {
root /var/www/html;
# Add index.php to the list if you are using PHP
index index.html index.htm index.nginx-debian.html;
server_name xml.completenoobs.com; # managed by Certbot
######^^
This block specifies the server configuration for requests that match the server name xml.completenoobs.com. The root directive specifies the root directory for this server block, and the index directive specifies the order in which Nginx should look for index files when serving requests. The server_name directive specifies the name of the server that this block handles.
######################
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
# To allow browsing of directory
autoindex on;
}
###########^^
This block specifies the location directive for requests that match the root directory of the server block. The try_files directive specifies that Nginx should first try to serve the request as a file, then as a directory, and then return a 404 error if the file or directory cannot be found. The autoindex directive enables directory listing for this location.
##############################
listen [::]:443 ssl ipv6only=on; # managed by Certbot
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/xml.completenoobs.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/xml.completenoobs.com/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
##################^^
These lines specify the SSL configuration for the server block, including the SSL certificates and keys, the SSL protocol settings, and the SSL Diffie-Hellman parameters. The listen directive specifies that the server block should listen for HTTPS connections on port 443, and the ssl parameter indicates that SSL/TLS should be used for these connections. The remaining lines specify the SSL certificates and keys, as well as the SSL options and Diffie-Hellman parameters managed by Certbot.
#########################
server {
if ($host = xml.completenoobs.com) {
return 301 https://$host$request_uri;
} # managed by Certbot
########^^
This block specifies that if the incoming request matches the server name xml.completenoobs.com, Nginx should return a 301 HTTP status code (Moved Permanently) and redirect the request to HTTPS.
#######################
listen 80 ;
listen [::]:80 ;
server_name xml.completenoobs.com;
return 404; # managed by Certbot
}
##########^^
These lines specify the server configuration for requests that match the server name xml.completenoobs.com on port 80 (the default HTTP port). The listen directives specify that the server block should listen for HTTP connections on both IPv4 and IPv6. The server_name directive specifies the name of the server that this block handles. The return 404 directive specifies that Nginx should return a 404 HTTP status code for all requests that match this server block.
Note that this server block is likely intended to be used in conjunction with another server block that handles HTTPS requests for xml.completenoobs.com, since the HTTP requests will be redirected to HTTPS by the if directive in this block.
############################
Hosting XML files for easy Downloading
we are going to delete the default index page and create another.
rm /var/www/html/index.nginx-debian.html
$EDITOR /var/www/html/index.html
Insert:
<!DOCTYPE html> <html> <head> <title>CompleteNoobs-XML_Dumps</title> </head> <body> <h1> <a href="xmlDumps/">Click here for are latest XML Dumps</a>.</p> </h1> </body> </html>
Create a Directory to place are dumps
mkdir /var/www/html/xmlDumps
This is the directory we will place are dumps for sharing and easy downloads.
chown -R www-data:www-data /var/www/html/xmlDumps
systemctl restart nginx
now create a test file with some content and test.
$EDITOR /var/www/html/xmlDumps/test.txt
Check you can see/read on web browser.
This is the directory where we will send are mediawiki dumps.
Transfer Files to Sharing Directory
scp
Check SCP_Examples for more examples:
To send direct from MediaWiki server (Example file 'xmlDump-03-03-2023')
Will be prompted to enter password:
scp /path/to/xmlDump-03-03-2023 root@xml.completenoobs.com:/var/www/html/xmlDumps/
sshfs
Can be useful if you are transferring a large number of files from your computer to server and want to use the GUI file explorer.
NOTE:replace $USER with your user account (Example: mine is 'ubunix' so i will replace '$USER' with 'ubunix')
Install sshfs on your computer
sudo apt install sshfs
Create a Directory you are going to mount remote server directory to:
mkdir /home/$USER/ServerMount
sudo sshfs -o allow_other,default_permissions root@xml.completenoobs.com:/var/www/html/xmlDumps/ /home/$USER/ServerMount/
To umount use:
sudo umount /home/$USER/ServerMount
Require Username and Password to view website/files (Optional - Placed here for educational reasons)
apt install apache2-utils
In your /etc/nginx/sites-available/default
Append the lines(see before and after files to see where):
auth_basic "Hello Please Login"; auth_basic_user_file /etc/nginx/.htpasswd;
/etc/nginx/sites-available/default: Before
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name 144.202.6.108;
return 302 https://$server_name$request_uri;
}
server {
# SSL configuration
#
listen 443 ssl default_server;
listen [::]:443 ssl default_server;
include snippets/ssl-params.conf;
root /var/www/html;
# Add index.php to the list if you are using PHP
index index.html index.htm index.nginx-debian.html;
server_name _;
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
# To allow browsing of directory
autoindex on;
}
}
/etc/nginx/sites-available/default: After
- You should look at the following URL's in order to grasp a solid understanding
- of Nginx configuration files in order to fully unleash the power of Nginx.
- https://www.nginx.com/resources/wiki/start/
- https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
- https://wiki.debian.org/Nginx/DirectoryStructure
- In most cases, administrators will remove this file from sites-enabled/ and
- leave it as reference inside of sites-available where it will continue to be
- updated by the nginx packaging team.
- This file will automatically load configuration files provided by other
- applications, such as Drupal or Wordpress. These applications will be made
- available underneath a path with that package name, such as /drupal8.
- Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
- Default server configuration
server { listen 80 default_server; listen [::]:80 default_server;
# SSL configuration # # listen 443 ssl default_server; # listen [::]:443 ssl default_server; # # Note: You should disable gzip for SSL traffic. # See: https://bugs.debian.org/773332 # # Read up on ssl_ciphers to ensure a secure configuration. # See: https://bugs.debian.org/765782 # # Self signed certs generated by the ssl-cert package # Don't use them in a production server! # # include snippets/snakeoil.conf;
root /var/www/html;
# Add index.php to the list if you are using PHP index index.html index.htm index.nginx-debian.html;
server_name _;
location / { # First attempt to serve request as file, then # as directory, then fall back to displaying a 404. try_files $uri $uri/ =404; }
# pass PHP scripts to FastCGI server # #location ~ \.php$ { # include snippets/fastcgi-php.conf; # # # With php-fpm (or other unix sockets): # fastcgi_pass unix:/run/php/php7.4-fpm.sock; # # With php-cgi (or other tcp sockets): # fastcgi_pass 127.0.0.1:9000; #}
# deny access to .htaccess files, if Apache's document root # concurs with nginx's one # #location ~ /\.ht { # deny all; #} }
- Virtual Host configuration for example.com
- You can move that to a different file under sites-available/ and symlink that
- to sites-enabled/ to enable it.
- server {
- listen 80;
- listen [::]:80;
- server_name example.com;
- root /var/www/example.com;
- index index.html;
- location / {
- try_files $uri $uri/ =404;
- }
- }
server {
# SSL configuration # # listen 443 ssl default_server; # listen [::]:443 ssl default_server; # # Note: You should disable gzip for SSL traffic. # See: https://bugs.debian.org/773332 # # Read up on ssl_ciphers to ensure a secure configuration. # See: https://bugs.debian.org/765782 # # Self signed certs generated by the ssl-cert package # Don't use them in a production server! # # include snippets/snakeoil.conf;
root /var/www/html;
# Add index.php to the list if you are using PHP index index.html index.htm index.nginx-debian.html;
server_name xml.completenoobs.com; # managed by Certbot
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
# To allow browsing of directory
autoindex on;
auth_basic "Hello Please Login";
auth_basic_user_file /etc/nginx/.htpasswd;
}
# pass PHP scripts to FastCGI server # #location ~ \.php$ { # include snippets/fastcgi-php.conf; # # # With php-fpm (or other unix sockets): # fastcgi_pass unix:/run/php/php7.4-fpm.sock; # # With php-cgi (or other tcp sockets): # fastcgi_pass 127.0.0.1:9000; #}
# deny access to .htaccess files, if Apache's document root # concurs with nginx's one # #location ~ /\.ht { # deny all; #}
listen [::]:443 ssl ipv6only=on; # managed by Certbot listen 443 ssl; # managed by Certbot ssl_certificate /etc/letsencrypt/live/xml.completenoobs.com/fullchain.pem; # managed by Certbot ssl_certificate_key /etc/letsencrypt/live/xml.completenoobs.com/privkey.pem; # managed by Certbot include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
} server {
if ($host = xml.completenoobs.com) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 80 ;
listen [::]:80 ;
server_name xml.completenoobs.com; return 404; # managed by Certbot
}
Create a login Username and Password to view your website
Add user; change user1 to username of your choice; you will be prompted for password.
htpasswd -c /etc/nginx/.htpasswd user1
The -c flag is only needed the first time to create the file /etc/nginx/.htpasswd
Add second user; the same method is used to add has many users has you want.
htpasswd /etc/nginx/.htpasswd user2
To update or change passwd for user, repeat command with username of account you wish to change; enter new password.
htpasswd /etc/nginx/.htpasswd user1
Restart Nginx:
systemctl restart nginx
And try site.
Fail2Ban to Block IP's Which Enter Incorrect Username and/or Password
Install Fail2Ban:
apt install fail2ban
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
$EDITOR /etc/fail2ban/jail.local
Note: Can append to the very bottom of the page.
# Reject Connections that failed username password _action_tcp_udp = %(banaction)s[name=%(__name__)s-tcp, protocol="tcp", port="%(port)s", blocktype="REJECT --reject-with tcp-reset", chain="%(chain)s", actname=%(banaction)s-tcp] %(banaction)s[name=%(__name__)s-udp, protocol="udp", port="%(port)s", blocktype="REJECT --reject-with icmp-port-unreachable", chain="%(chain)s", actname=%(banaction)s-udp] actionx = %(_action_tcp_udp)s [nginx-cup] #the name in brackets above is what you use for status # fail2ban-client status nginx-cup enabled = true filter = nginx-correct-up port = http,https logpath = /var/log/nginx/error.log findtime = 3m bantime = 3m maxretry = 3 #ignoreip = <your-ipaddress> #Note: Can find your ipaddress using `curl ifconfig.me` or visit `whatismyip.com`
$EDITOR /etc/fail2ban/filter.d/nginx-correct-up.conf
[Definition] failregex = client:\s<HOST> ignoreregex =
Check Fail2Ban for errors
fail2ban-client -d
restart nginx and fail2ban so updated setting can take effect
systemctl restart fail2ban.service
systemctl restart nginx.service
And test.
Remove need for username and password
Comment out (or delete) the following lines from your nginx config file:
$EDITOR /etc/nginx/sites-available/default
auth_basic "Hello Please Login"; auth_basic_user_file /etc/nginx/.htpasswd;
Can comment out lines by placing a '#' in front.
#auth_basic "Hello Please Login"; #auth_basic_user_file /etc/nginx/.htpasswd;
Restart Nginx:
systemctl restart nginx
No DNS using IP and SelfSigned Certs
Update system
apt update && apt upgrade -y
Install NGINX
apt install nginx -y
You should now be able to see the Welcome to nginx! site on your subdomain (or just use server ip address).
Only http will work as we have not yet setup are https
Create keys for encrypted https connection
Note: If you are just building a quick website to test this out you can use Blank (just press enter) for all fields and it will still work.
openssl req -x509 -nodes -days 365 -newkey rsa:4096 -keyout /etc/ssl/private/nginx-selfsigned.key -out /etc/ssl/certs/nginx-selfsigned.crt
quick explanation:
- openssl: This command invokes the OpenSSL tool, which is a software library that provides a variety of cryptographic functions and utilities.
- req: This is a subcommand of OpenSSL that is used for creating and managing X.509 certificate signing requests (CSRs) and self-signed certificates.
- -x509: This option specifies that the output should be a self-signed X.509 certificate rather than a CSR.
- -nodes: This option specifies that the private key should not be encrypted with a password, allowing for automatic startup of services that use SSL/TLS.
- -days 365: This option specifies the number of days that the certificate will be valid for before it expires.
- -newkey rsa:4096: This option generates a new RSA private key with a key length of 4096 bits, which provides a higher level of security than shorter key lengths.
- -keyout /etc/ssl/private/nginx-selfsigned.key: This option specifies the path and filename of the private key file that will be generated by OpenSSL.
- -out /etc/ssl/certs/nginx-selfsigned.crt: This option specifies the path and filename of the self-signed certificate file that will be generated by OpenSSL.
Overall, this command generates a self-signed SSL/TLS certificate and private key that can be used to secure an Nginx web server. The certificate and key are saved to the specified locations for use in the Nginx server configuration. It's important to note that while self-signed certificates can provide some level of encryption for your web traffic, they do not provide any form of authentication or verification of identity, and should not be used in production environments where security is a top priority.
/etc/ssl/private/nginx-selfsigned.key
/etc/ssl/certs/nginx-selfsigned.crt
Create diffhelman
openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048
You can upgrade from 2048 to 4096 but it might take a while.
$EDITOR /etc/nginx/snippets/ssl-params.conf
Nginx configuration directives related to SSL/TLS:
ssl_protocols TLSv1.2; #This directive specifies the SSL/TLS protocols that the server will use for secure connections. In this case, only TLS version 1.2 is allowed. ssl_prefer_server_ciphers on; #This directive tells the server to prefer the ciphers specified by the server over those requested by the client. ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:!aNULL:!eNULL !LOW !DSS !MD5 !RC4 !EXP !PSK !SRP !CAMELLIA !SEED'; #This directive specifies the SSL/TLS ciphers that the server will use for secure connections. These ciphers prioritize the use of elliptic curve cryptography (ECDHE) for key exchange and advanced encryption algorithms such as AES256 and CHACHA20-POLY1305 for encryption. ssl_ecdh_curve secp384r1; #This directive specifies the elliptic curve Diffie-Hellman (ECDH) curve that the server will use for key exchange. In this case, the secp384r1 curve is used. ssl_session_cache shared:SSL:10m; ssl_session_tickets off; #These directives configure SSL session caching, which can improve performance by allowing the server to reuse SSL session parameters for multiple connections. The ssl_session_cache directive specifies the type of session cache to use, and the ssl_session_tickets directive specifies whether session tickets should be used. # need to turn ssl_stapling off for selfsigned or will get errors in /var/log/nginx/error.log ssl_stapling off; ssl_stapling_verify off; #These directives configure OCSP stapling, which can improve security by allowing the server to provide proof of the SSL/TLS certificate's validity without requiring the client to contact the certificate authority. The ssl_stapling directive specifies whether stapling should be used, and the ssl_stapling_verify directive specifies whether the server should verify the OCSP response from the certificate authority. resolver 8.8.8.8 80.80.80.80 valid=300s; resolver_timeout 5s; #These directives configure DNS resolution for OCSP stapling. The resolver directive specifies the DNS servers to use for resolving OCSP requests, and the valid parameter specifies the duration for which DNS responses will be cached. The resolver_timeout directive specifies the timeout value for DNS resolution. add_header Strict-Transport-Security "max-age=63072000; includeSubdomains"; add_header X-Frame-Options DENY; add_header X-Content-Type-Options nosniff; #These directives add security-related HTTP headers to responses sent by the server. The Strict-Transport-Security header specifies that SSL/TLS should always be used for connections to the server, and the X-Frame-Options and X-Content-Type-Options headers help protect against clickjacking and MIME sniffing attacks, respectively. ssl_dhparam /etc/ssl/certs/dhparam.pem; #This directive specifies the location of the Diffie-Hellman parameters file used for SSL/TLS key exchange. The ssl_dhparam directive is used to specify the path to the file that contains the Diffie-Hellman parameters. ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt; # self-signed certificate file ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key; # private key file
Nginx
$EDITOR /etc/nginx/sites-available/default
MAKE SURE TO CHANGE IP 12.34.56.78 to YOUR servers Public IP address
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name 12.34.56.78; ## change ip to match your server ip
return 302 https://$server_name$request_uri;
}
server {
# SSL configuration
#
listen 443 ssl default_server;
listen [::]:443 ssl default_server;
include snippets/ssl-params.conf;
root /var/www/html;
# Add index.php to the list if you are using PHP
index index.html index.htm index.nginx-debian.html;
server_name _;
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
# To allow browsing of directory
autoindex on;
}
}
Restart Nginx
systemctl restart nginx
Allow Nginx pass firewall
ufw allow 80/tcp
ufw allow 443/tcp
mkdir /var/www/html/files
Create an html file
$EDITOR /var/www/html/index.html
<!DOCTYPE html> <html> <head> <title>Files For Download</title> </head> <body> <a href="files">Click here for are latest files</a>.</p> </body> </html>
Transfer_Files_to_Sharing_Directory
Same as with using certbot
Require Username and Passwd to view files