Hello,

I'm settign an access control for Drupal cron.php that is invoked via
a cron job.

I tried two approaches and both seem to work

1. Use the Access module and specify the allowed host.

location /cron.php {
deny all;
allow 127.0.0.1;
allow 192.168.1.0/24;
fastcgi_pass 127.0.0.1:9000;
}

2. Use a conditional.

location /cron.php {
if ($remote_adrr ~* (192\.168\.1\.(1|2)|127\.0\.0\.1)) {
fastcgi_pass 127.0.0.1:9000;
}
return 404;
}

Travelling down the somewhat dubious path of security by obscurity I
find that returning 404 revals less than a 403.

But I'm aware that it's a pretty scant justification for using a
conditional. In terms of efficiency which approach is preferred?

BTW I tried to use a non-capturing group but if failed. It always
returned the 404. I tried this:

location /cron.php {
if ($remote_adrr ~* (?:192\.168\.1\.(?:1|2)|127\.0\.0\.1)) {
fastcgi_pass 127.0.0.1:9000;
}
return 404;
}

I suppose libpcre3 implements all of PCRE, including non-capturing
groups. Is this a limitation of nginx regex handling? Or I'm I
misundertanding something more fundamental in what nginx conditionals
and regex handling is concerned?

Thank you,
António

_______________________________________________
nginx mailing list
nginx@nginx.org
http://nginx.org/mailman/listinfo/nginx