Should a webserver's access to certain directories be limited?

Question

There was a security update to Roundcubemail today and I just patched my web/mail -server. Within the update files, there was some recommendations to restrict webserver's access to certain directories. Is this necessary, and if it is, how should I go about implementing it in Nginx?

Check .htaccess settings (some php settings could become required)

I literally have no idea what I'm supposed to look for in .htaccess settings. Additionally:

Access through the webserver to the following directories should be denied:

/config
/temp
/logs

Roundcube uses .htaccess files to protect these directories, so be sure to allow override of the Limit directives to get them taken into account. The package also ships a .htaccess file in the root directory which defines some rewrite rules. In order to properly secure your installation, please enable mod_rewrite for Apache webserver and double check access to the above listed directories and their contents is denied.

I'm running Nginx, not Apache, and I found this - basicly Nginx advising people to not use .htaccess due to performance reasons.

Answer 1

Nginx should indeed have access blocked to arbitrary locations on your filesystem. In short, if it doesn't need access, don't give it any, because that limits the damage it could do. This applies to both read and write, and can be done by running nginx as its own user (probably the default on your system), not adding that user to common groups, and being restrictive about your filesystem permissions on the rest of the system (i.e. don't use 777 just because you're having troubles getting the right permission set). You may also wish to look into SELinux for more advanced controls.

The warning you have there is an extension of that idea. Outside users don't need to be able to read your nginx config, but the nginx user does. These files should never be located in one of your document roots, but nonetheless you should have nginx rules that block any requests to them (the specifics of the rules is off-topic for here, but would fit well on Server Fault).