location ~^/cgi-bin/.*\.(cgi|pl|py|rb) {
gzip off;
fastcgi_pass 127.0.0.1:9000;
fastcgi_index cgi-bin.PHP;
fastcgi_param SCRIPT_FILENAME /etc/Nginx/cgi-bin.PHP;
fastcgi_param SCRIPT_NAME /cgi-bin/cgi-bin.PHP;
fastcgi_param X_SCRIPT_FILENAME /usr/lib/$fastcgi_script_name;
fastcgi_param X_SCRIPT_NAME $fastcgi_script_name;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
fastcgi_param SERVER_SOFTWARE Nginx;
fastcgi_param REQUEST_URI $request_uri;
fastcgi_param DOCUMENT_URI $document_uri;
fastcgi_param DOCUMENT_ROOT $document_root;
fastcgi_param SERVER_PROTOCOL $server_protocol;
fastcgi_param REMOTE_ADDR $remote_addr;
fastcgi_param REMOTE_PORT $remote_port;
fastcgi_param SERVER_ADDR $server_addr;
fastcgi_param SERVER_PORT $server_port;
fastcgi_param SERVER_NAME $server_name;
fastcgi_param REMOTE_USER $remote_user;
}
PHP脚本：
PHP
$descriptorspec = array(
0 => array("pipe","r"),// stdin is a pipe that the child will read from
1 => array("pipe","w"),// stdout is a pipe that the child will write to
2 => array("pipe","w") // stderr is a file to write to
);
$newenv = $_SERVER;
$newenv["SCRIPT_FILENAME"] = $_SERVER["X_SCRIPT_FILENAME"];
$newenv["SCRIPT_NAME"] = $_SERVER["X_SCRIPT_NAME"];
if (is_executable($_SERVER["X_SCRIPT_FILENAME"])) {
$process = proc_open($_SERVER["X_SCRIPT_FILENAME"],$descriptorspec,$pipes,NULL,$newenv);
if (is_resource($process)) {
fclose($pipes[0]);
$head = fgets($pipes[1]);
while (strcmp($head,"\n")) {
header($head);
$head = fgets($pipes[1]);
}
fpassthru($pipes[1]);
fclose($pipes[1]);
fclose($pipes[2]);
$return_value = proc_close($process);
}
else {
header("Status: 500 Internal Server Error");
echo("Internal Server Error");
}
}
else {
header("Status: 404 Page Not Found");
echo("Page Not Found");
}
?>
它的问题是我无法添加基本身份验证.
一旦我为位置〜/ cgi-bin启用它,当我尝试查找它时,它会给我一个404错误.
我怎么解决这个问题？
我想限制只访问我的第二台服务器,然后我在代理上添加基本身份验证,但必须有一个更简单的解决方案.
抱歉标题不好,我想不出更好的一个.
编辑：我的解决方案,感谢WerkkreWs answer,最终看起来像这样：
CGI-bin.conf：
location ~^/.*\.(cgi|pl|p<|rb) {
[...]
}
vhost.conf：
server {
[...]
location ~^/cgi-bin {
auth_basic "Restricted";
auth_basic_user_file htusers;
include cgi-bin.conf;
}
[...]
}
这可能是不安全的,因为cgi-bin.conf可能会意外地包含在服务器标签中(从而使每个客户端都能在每个位置执行脚本),但由于我只使用它一次,我将坚持使用此解决方案.
最佳答案
我相信你的问题可能已经回答了here,但我会尝试描述我认为问题所在.
原文链接：https://www.f2er.com/nginx/435476.html首先,除此之外,您应该考虑将所有fastcgi参数放在Nginx可访问的configurastion文件中以便于使用(例如/etc/Nginx/conf.d/fastcgi_params).
其次,根据你如何设置auth与PHP部分的位置块,你可能需要指示Nginx如何在受保护的位置再次处理PHP文件,或者确保auth_basic指令在例如,与上面粘贴的位置块相同的位置块(取自上述帖子)：
server {
listen 80;
server_name my-awesome-PHP.site;
root /path/to/root;
# Normal files (blank location is OK,just means serve from root)
location / { }
# PHP for normal stuff
location ~ \.PHP${
include fastcgi.conf;
fastcgi_pass 127.0.0.1:9000;
}
# The protected location
location /protected {
auth_basic "Give me codes.";
auth_basic_user_file /path/to/.htpasswd;
location ~ \.PHP${
include fastcgi.conf;
fastcgi_pass 127.0.0.1:9000;
}
}
}
在我个人安装的Nginx上我使用的是PHP-fpm,我的PHP脚本不仅限于cgi-bin,所以我的配置完全不同,但它可能会为你提供一些额外的见解.我有基本的身份验证工作,因为我想你会期待它虽然在下面的例子中整个vhost是在基本身份验证而不仅仅是一个文件夹：
fastcgi_params
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
fastcgi_param REQUEST_URI $request_uri;
fastcgi_param DOCUMENT_URI $document_uri;
fastcgi_param DOCUMENT_ROOT $document_root;
fastcgi_param SERVER_PROTOCOL $server_protocol;
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
fastcgi_param SERVER_SOFTWARE Nginx/$Nginx_version;
fastcgi_param REMOTE_ADDR $remote_addr;
fastcgi_param REMOTE_PORT $remote_port;
fastcgi_param SERVER_ADDR $server_addr;
fastcgi_param SERVER_PORT $server_port;
fastcgi_param SERVER_NAME $server_name;
# PHP only,required if PHP was built with --enable-force-cgi-redirect
fastcgi_param REDIRECT_STATUS 200;
基于服务器/主机的身份验证示例(删除了不相关的部分)
server {
server_name dev.foo.com;
error_log /app/www/dev.foo.com/logs/error.log error;
root /app/www/dev.foo.com/htdocs;
index index.PHP index.html;
auth_basic "Secret Files";
auth_basic_user_file /app/www/dev.foo.com/conf/htpasswd;
location ~ \.PHP${
include /etc/Nginx/fastcgi_params;
fastcgi_index index.PHP;
fastcgi_split_path_info ^(.+\.PHP)(.*)$;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass unix:/var/run/foo.com.sock;
}
location ~ /\.ht {
deny all;
}
}
基于位置的身份验证示例(删除了不相关的部分)
server {
server_name foo.com;
error_log /app/www/foo.com/logs/error.log error;
root /app/www/foo.com/htdocs;
index index.PHP index.html;
location /protected {
auth_basic "Secret Files";
auth_basic_user_file /app/www/foo.com/conf/htpasswd;
location ~ \.PHP${
include /etc/Nginx/fastcgi_params;
fastcgi_index index.PHP;
fastcgi_split_path_info ^(.+\.PHP)(.*)$;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass unix:/var/run/foo.com.sock;
}
}
location ~ \.PHP${
include /etc/Nginx/fastcgi_params;
fastcgi_index index.PHP;
fastcgi_split_path_info ^(.+\.PHP)(.*)$;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass unix:/var/run/foo.com.sock;
}
location ~ /\.ht {
deny all;
}
}
