There was a security update to Roundcubemail today and I just patched my web/mail -server. Within the update files, there was some recommendations to restrict webserver's access to certain directories. Is this necessary, and if it is, how should I go about implementing it in Nginx?
Check .htaccess settings (some php settings could become required)
I literally have no idea what I'm supposed to look for in .htaccess settings. Additionally:
Access through the webserver to the following directories should be denied:
Roundcube uses .htaccess files to protect these directories, so be sure to allow override of the Limit directives to get them taken into account. The package also ships a .htaccess file in the root directory which defines some rewrite rules. In order to properly secure your installation, please enable mod_rewrite for Apache webserver and double check access to the above listed directories and their contents is denied.
I'm running Nginx, not Apache, and I found this - basicly Nginx advising people to not use .htaccess due to performance reasons.