<html><head><meta http-equiv="Content-Security-Policy" content="script-src 'self'; img-src * cid: data:;"></head><body style="background-color: rgb(255, 255, 255); background-image: initial; line-height: initial;"><div id="response_container_BBPPID" style="outline:none;" dir="auto" contenteditable="false"> <div name="BB10" id="BB10_response_div_BBPPID" dir="auto" style="width:100%;"> Your basic idea is right, but what you want to do is use a "map." I will follow up with more details when I can pull the code off my server. </div><div name="BB10" id="BB10_response_div_BBPPID" dir="auto" style="width:100%;"><br></div><div name="BB10" id="BB10_response_div_BBPPID" dir="auto" style="width:100%;">I 444 a number of services that I don't use. I have a script to find the IP addresses of those that trigger a 444 from access.log. If they come from a data center, hosting service, etc., they get on a blocking list for my firewall. I block the entire IP space. </div> <div name="BB10" id="response_div_spacer_BBPPID" dir="auto" style="width:100%;"> <br style="display:initial"></div> <div id="blackberry_signature_BBPPID" name="BB10" dir="auto"> <div id="_signaturePlaceholder_BBPPID" name="BB10" dir="auto"></div> </div></div><div id="_original_msg_header_BBPPID" dir="auto"> <table width="100%" style="background-color: white; border-spacing: 0px; display: table; outline: none;" contenteditable="false"><tbody><tr><td colspan="2" style="padding: initial; font-size: initial; text-align: initial; background-color: rgb(255, 255, 255);"> <div style="border-right: none; border-bottom: none; border-left: none; border-image: initial; border-top: 1pt solid rgb(181, 196, 223); padding: 3pt 0in 0in; font-family: Tahoma, "BB Alpha Sans", "Slate Pro"; font-size: 10pt;"> <div id="from"><b>From:</b> michael.friscia@yale.edu</div><div id="sent"><b>Sent:</b> March 19, 2018 5:31 AM</div><div id="to"><b>To:</b> nginx@nginx.org</div><div id="reply_to"><b>Reply-to:</b> nginx@nginx.org</div><div id="subject"><b>Subject:</b> Aborting malicious requests</div></div></td></tr></tbody></table> <br> </div><!--start of _originalContent --><div name="BB10" dir="auto" style="background-image: initial; line-height: initial; outline: none;" contenteditable="false"><div id="ssc7600"><style>#ssc7600 p.MsoNormal,#ssc7600 li.MsoNormal,#ssc7600 div.MsoNormal{margin: 0in;margin-bottom: 1.0E-4pt;font-size: 12pt;font-family: "Calibri", sans-serif;}#ssc7600 a:link,#ssc7600 span.MsoHyperlink{color: rgb(5, 99, 193);text-decoration: underline;}#ssc7600 a:visited,#ssc7600 span.MsoHyperlinkFollowed{color: rgb(149, 79, 114);text-decoration: underline;}#ssc7600 span.msoIns{text-decoration: underline;color: teal;}#ssc7600 .MsoChpDefault{font-family: "Calibri", sans-serif;}#ssc7600 div.WordSection1{}</style><div><div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11pt">Just a thought before I start crafting one. I am creating a location{} block with the intention of populating it with a ton of requests I want to terminate immediately with a 444 response. Before I start,
I thought I’d ask to see if anyone has a really good one I can use as a base.</span></p>
<p class="MsoNormal"><span style="font-size:11pt"> </span></p>
<p class="MsoNormal"><span style="font-size:11pt">For example, we don’t serve PHP so I’m starting with
</span></p>
<p class="MsoNormal"><span style="font-size:11pt">Location ~* .php {<!-- --></span></p>
<p class="MsoNormal"><span style="font-size:11pt">Return 444;</span></p>
<p class="MsoNormal"><span style="font-size:11pt">}</span></p>
<p class="MsoNormal"><span style="font-size:11pt"> </span></p>
<p class="MsoNormal"><span style="font-size:11pt">Then I can just include this into all my server blocks so I can manage the aborts all in one place. This alone reduces errors in the logs significantly. But now I will have to start adding in all the wordpress
stuff, then onto php myadmin, etc. I will end up with something like</span></p>
<p class="MsoNormal"><span style="font-size:11pt"> </span></p>
<p class="MsoNormal"><span style="font-size:11pt">Location ~* (.php|wp-admin|my-admin) {<!-- --></span></p>
<p class="MsoNormal"><span style="font-size:11pt">Return 444;</span></p>
<p class="MsoNormal"><span style="font-size:11pt">}</span></p>
<p class="MsoNormal"><span style="font-size:11pt"> </span></p>
<p class="MsoNormal"><span style="font-size:11pt">I can imagine the chunk inside the parenthesis is going to be pretty huge which is why I thought I’d reach out to see if anyone has one already.</span></p>
<p class="MsoNormal"><span style="font-size:11pt"> </span></p>
<p class="MsoNormal"><span style="font-size:11pt">Thanks,</span></p>
<p class="MsoNormal"><span style="font-size:11pt">-mike</span></p>
<p class="MsoNormal"><span style="font-size:11pt"> </span></p>
<p class="MsoNormal"><span style="font-size:10pt;color:#44546a">___________________________________________</span></p>
<p class="MsoNormal"><span style="font-size:10pt;color:#44546a">Michael Friscia</span></p>
<p class="MsoNormal"><span style="font-size:10pt;color:#44546a">Office of Communications</span></p>
<p class="MsoNormal"><span style="font-size:10pt;color:#44546a">Yale School of Medicine</span></p>
<p class="MsoNormal"><span style="font-size:10pt;color:#44546a"><a href="tel:(203)7377932">(203) 737-7932</a> - office</span></p>
<p class="MsoNormal"><span style="font-size:10pt;color:#44546a"><a href="tel:(203)9315381">(203) 931-5381</a> - mobile</span></p>
<p class="MsoNormal"><span style="font-size:10pt;color:#44546a"><a href="http://web.yale.edu/"><span style="color:#44546a">http://web.yale.edu</span></a></span></p>
<p class="MsoNormal"> </p>
</div></div>
</div><!--end of _originalContent --></div></body></html>