nginx 不阻止用户代理

Question

我在.conf我的网站文件中有这个内容，试图阻止 2 个用户代理不断探测我的服务器。

## Block http user agent - morpheus fucking scanner ##
if ($http_user_agent ~* "morfeus fucking scanner|ZmEu") {
   return 403;
}

我也尝试过以下方法，但没有成功：

if ($http_user_agent ~* ("morfeus fucking scanner|ZmEu"))
if ($http_user_agent ~* (morfeus fucking scanner|ZmEu))
if ($http_user_agent ~* ("morfeus fucking scanner"|"ZmEu"))
if ($http_user_agent ~* "morfeus fucking scanner|ZmEu")
if ($http_user_agent ~* morfeus fucking scanner|ZmEu)

当我只有 1 个用户代理时，它运行良好，但在尝试添加第二个用户代理时，这些用户代理仍然能够探测服务器。

111.90.172.235 - - [17/Feb/2013:23:05:22 -0700] "GET /phpMyAdmin/scripts/setup.php HTTP/1.1" 404 118 "-" "ZmEu" "-"
111.90.172.235 - - [17/Feb/2013:23:05:22 -0700] "GET /MyAdmin/scripts/setup.php HTTP/1.1" 404 118 "-" "ZmEu" "-"
111.90.172.235 - - [17/Feb/2013:23:05:22 -0700] "GET /pma/scripts/setup.php HTTP/1.1" 404 118 "-" "ZmEu" "-"
111.90.172.235 - - [17/Feb/2013:23:05:22 -0700] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 403 118 "-" "ZmEu" "-"
111.90.172.235 - - [17/Feb/2013:23:05:22 -0700] "GET /myadmin/scripts/setup.php HTTP/1.1" 404 118 "-" "ZmEu" "-"
111.90.172.235 - - [17/Feb/2013:23:05:22 -0700] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 118 "-" "ZmEu" "-"

根据这两篇帖子#12：如何拒绝某些用户代理？，操作方法：Nginx 阻止用户代理，我认为我的设置正确，但它似乎不起作用。

---

编辑

这是 nginx 版本和整个配置文件

nginx version: nginx/1.2.7

server {
listen       80;
server_name  localhost;

#charset koi8-r;

access_log  /var/log/nginx/XXXXXX/access.log  main;
error_log /var/log/nginx/XXXXXX/error.log;

root /srv/www/XXXXXX;

location / {
    index  index.html index.htm index.php;

    #5/22/2012 - Turn on Server Side Includes
    ssi on;

    ## Block http user agent - morpheus fucking scanner ##
    if ($http_user_agent ~* "morfeus fucking scanner|ZmEu") {
       return 403;
    }

    ## Only allow GET and HEAD request methods. By default Nginx blocks
    ## all requests type other then GET and HEAD for static content.
    if ($request_method !~ ^(GET|HEAD)$ ) {
      return 405;
    }
}

location ~ \.php {
    try_files $uri =404;
    include /etc/nginx/fastcgi_params;
    fastcgi_pass 127.0.0.1:9000;
    #fastcgi_index index.php;
    fastcgi_param SCRIPT_FILENAME /srv/www/XXXXXX/$fastcgi_script_name;
}

#error_page  404              /404.html;

# redirect server error pages to the static page /50x.html
error_page   500 502 503 504  /50x.html;
location = /50x.html {
    root   /usr/share/nginx/html;
}

# Redirect server error pages to the static page
error_page 403 404 /error403.html;
location = /error403.html {
    root /usr/share/nginx/html;
}

Answer 1

nginx 仅适用于一在配置的每个级别使用 location 块。所有 404 错误文件都是.php命中\.phplocation 块的文件，因此不要使用/包含用户代理块的 location 块。要解决此问题，请将用户代理块移出 location 块并移至根级别，以便将其应用于所有请求。

if ($http_user_agent ~* "morfeus fucking scanner|ZmEu") {
    return 403;
}

location / {
    ...
}

location \.php {
    ...
}

编辑：您可以使用类似方法来测试这一点curl，它可以设置任意标题：

% curl -I localhost/sf645/blah
HTTP/1.1 404 Not Found
% curl -I -H 'User-agent: ZmEu' localhost/sf645/blah
HTTP/1.1 403 Forbidden
% curl -I -H 'User-agent: morfeus fucking scanner' localhost/sf645/blah
HTTP/1.1 403 Forbidden

Answer 2

尝试这个

if ($http_user_agent ~* (morfeus|ZmEu) ) {
   return 403;
}

Answer 3

尝试仅使用模式(morfeus)。该管道字符可能会搞砸正则表达式模式匹配。