<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body dir="auto">
Thank you Gary, I really appreciate you moving me in the right direction.<br>
<br>
<div id="AppleMailSignature">Sent from my iPhone with all its odd spell checks</div>
<div><br>
On Mar 19, 2018, at 9:36 AM, Gary <<a href="mailto:lists@lazygranch.com">lists@lazygranch.com</a>> wrote:<br>
<br>
</div>
<blockquote type="cite">
<div>
<meta http-equiv="Content-Security-Policy" content="script-src 'self'; img-src * cid: data:;">
<div id="response_container_BBPPID" style="outline:none;" dir="auto" contenteditable="false">
<div name="BB10" id="BB10_response_div_BBPPID" dir="auto" style="width:100%;">Your basic idea is right, but what you want to do is use a "map." I will follow up with more details when I can pull the code off my server. </div>
<div name="BB10" id="BB10_response_div_BBPPID" dir="auto" style="width:100%;"><br>
</div>
<div name="BB10" id="BB10_response_div_BBPPID" dir="auto" style="width:100%;">I 444 a number of services that I don't use. I have a script to find the IP addresses of those that trigger a 444 from access.log. If they come from a data center, hosting service,
etc., they get on a blocking list for my firewall. I block the entire IP space. </div>
<div name="BB10" id="response_div_spacer_BBPPID" dir="auto" style="width:100%;"><br style="display:initial">
</div>
<div id="blackberry_signature_BBPPID" name="BB10" dir="auto">
<div id="_signaturePlaceholder_BBPPID" name="BB10" dir="auto"></div>
</div>
</div>
<div id="_original_msg_header_BBPPID" dir="auto">
<table width="100%" style="background-color: white; border-spacing: 0px; display: table; outline: none;" contenteditable="false">
<tbody>
<tr>
<td colspan="2" style="padding: initial; font-size: initial; text-align: initial; background-color: rgb(255, 255, 255);">
<div style="border-right: none; border-bottom: none; border-left: none; border-image: initial; border-top: 1pt solid rgb(181, 196, 223); padding: 3pt 0in 0in; font-family: Tahoma, "BB Alpha Sans", "Slate Pro"; font-size: 10pt;">
<div id="from"><b>From:</b> <a href="mailto:michael.friscia@yale.edu">michael.friscia@yale.edu</a></div>
<div id="sent"><b>Sent:</b> March 19, 2018 5:31 AM</div>
<div id="to"><b>To:</b> <a href="mailto:nginx@nginx.org">nginx@nginx.org</a></div>
<div id="reply_to"><b>Reply-to:</b> <a href="mailto:nginx@nginx.org">nginx@nginx.org</a></div>
<div id="subject"><b>Subject:</b> Aborting malicious requests</div>
</div>
</td>
</tr>
</tbody>
</table>
<br>
</div>
<!--start of _originalContent -->
<div name="BB10" dir="auto" style="background-image: initial; line-height: initial; outline: none;" contenteditable="false">
<div id="ssc7600"><style>#ssc7600 p.MsoNormal,#ssc7600 li.MsoNormal,#ssc7600 div.MsoNormal{margin: 0in;margin-bottom: 1.0E-4pt;font-size: 12pt;font-family: "Calibri", sans-serif;}#ssc7600 a:link,#ssc7600 span.MsoHyperlink{color: rgb(5, 99, 193);text-decoration: underline;}#ssc7600 a:visited,#ssc7600 span.MsoHyperlinkFollowed{color: rgb(149, 79, 114);text-decoration: underline;}#ssc7600 span.msoIns{text-decoration: underline;color: teal;}#ssc7600 .MsoChpDefault{font-family: "Calibri", sans-serif;}#ssc7600 div.WordSection1{}</style>
<div>
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11pt">Just a thought before I start crafting one. I am creating a location{} block with the intention of populating it with a ton of requests I want to terminate immediately with a 444 response. Before I start, I
thought I’d ask to see if anyone has a really good one I can use as a base.</span></p>
<p class="MsoNormal"><span style="font-size:11pt"> </span></p>
<p class="MsoNormal"><span style="font-size:11pt">For example, we don’t serve PHP so I’m starting with
</span></p>
<p class="MsoNormal"><span style="font-size:11pt">Location ~* .php {<!-- --></span></p>
<p class="MsoNormal"><span style="font-size:11pt">Return 444;</span></p>
<p class="MsoNormal"><span style="font-size:11pt">}</span></p>
<p class="MsoNormal"><span style="font-size:11pt"> </span></p>
<p class="MsoNormal"><span style="font-size:11pt">Then I can just include this into all my server blocks so I can manage the aborts all in one place. This alone reduces errors in the logs significantly. But now I will have to start adding in all the wordpress
stuff, then onto php myadmin, etc. I will end up with something like</span></p>
<p class="MsoNormal"><span style="font-size:11pt"> </span></p>
<p class="MsoNormal"><span style="font-size:11pt">Location ~* (.php|wp-admin|my-admin) {<!-- --></span></p>
<p class="MsoNormal"><span style="font-size:11pt">Return 444;</span></p>
<p class="MsoNormal"><span style="font-size:11pt">}</span></p>
<p class="MsoNormal"><span style="font-size:11pt"> </span></p>
<p class="MsoNormal"><span style="font-size:11pt">I can imagine the chunk inside the parenthesis is going to be pretty huge which is why I thought I’d reach out to see if anyone has one already.</span></p>
<p class="MsoNormal"><span style="font-size:11pt"> </span></p>
<p class="MsoNormal"><span style="font-size:11pt">Thanks,</span></p>
<p class="MsoNormal"><span style="font-size:11pt">-mike</span></p>
<p class="MsoNormal"><span style="font-size:11pt"> </span></p>
<p class="MsoNormal"><span style="font-size:10pt;color:#44546a">___________________________________________</span></p>
<p class="MsoNormal"><span style="font-size:10pt;color:#44546a">Michael Friscia</span></p>
<p class="MsoNormal"><span style="font-size:10pt;color:#44546a">Office of Communications</span></p>
<p class="MsoNormal"><span style="font-size:10pt;color:#44546a">Yale School of Medicine</span></p>
<p class="MsoNormal"><span style="font-size:10pt;color:#44546a"><a href="tel:(203)7377932">(203) 737-7932</a> - office</span></p>
<p class="MsoNormal"><span style="font-size:10pt;color:#44546a"><a href="tel:(203)9315381">(203) 931-5381</a> - mobile</span></p>
<p class="MsoNormal"><span style="font-size:10pt;color:#44546a"><a href="http://web.yale.edu/"><span style="color:#44546a">http://web.yale.edu</span></a></span></p>
<p class="MsoNormal"> </p>
</div>
</div>
</div>
<!--end of _originalContent --></div>
</div>
</blockquote>
<blockquote type="cite">
<div><span>_______________________________________________</span><br>
<span>nginx mailing list</span><br>
<span><a href="mailto:nginx@nginx.org">nginx@nginx.org</a></span><br>
<span><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__mailman.nginx.org_mailman_listinfo_nginx&d=DwICAg&c=cjytLXgP8ixuoHflwc-poQ&r=wvXEDjvtDPcv7AlldT5UvDx32KXBEM6um_lS023SJrs&m=MMFd1g-YpouXJolEFUG9wADYPEA1sPlvQ_GvUe4zJHk&s=JRurMbCby9FTsTmkiXgHZcPzDsixrqBHKRyZb2qSny4&e=">https://urldefense.proofpoint.com/v2/url?u=http-3A__mailman.nginx.org_mailman_listinfo_nginx&d=DwICAg&c=cjytLXgP8ixuoHflwc-poQ&r=wvXEDjvtDPcv7AlldT5UvDx32KXBEM6um_lS023SJrs&m=MMFd1g-YpouXJolEFUG9wADYPEA1sPlvQ_GvUe4zJHk&s=JRurMbCby9FTsTmkiXgHZcPzDsixrqBHKRyZb2qSny4&e=</a></span></div>
</blockquote>
</body>
</html>