Clement Nedelcu's Development Journal

Hello, I am glad to to announce the first Nginx book on the market: Nginx HTTP Server , written by... me . :-) NGINX HTTP SERVER "Adopt Nginx for your web applications to make the most of your infrastructure and server pages faster than ever." Focused on the primary aspect of Nginx (HTTP serving), the book covers the following topics: Get started with Nginx to serve websites faster and safer Learn to configure your servers and virtual hosts efficiently Set up Nginx to work with PHP and other applications via FastCGI Explore possible interactions between Nginx and Apache to get the best of both worlds A step-by-step guide to switching from Apache to Nginx Complete configuration directive and module reference There are 8 chapters and 3 appendices, listed here: 1. Preparing your work environment: getting ready to work under a command-line environment, with a reminder on the basic tools and commands. 2. Downloading and installing Nginx : downloading the source, th...

A critical security issue has recently been pointed out on servers that run Nginx and PHP via FastCGI. The issue allows anyone to execute their own PHP code on the system, I don't think I have to remind you of the consequences this could have. I will attempt to provide a simple explanation of the issue and more importantly how to fix it. What is the issue? I would like to begin by discussing the nature of the problem: it is not caused by Nginx itself - it is not a bug or a security breach in itself. Actually, it is the way that people usually configure Nginx FastCGI options to work with PHP, and how PHP reacts to that configuration. Pretty much everyone adopts the same configuration without being aware of the issue. The issue itself can be understood simply, then I will explain why PHP behaves that way. Most dynamic websites allow for a reason or another uploading of files. Say, I'm running a forum-based community, users can upload images to use as personal photo or ava...