deny in http {}, get 500 response , how to log this?

[Maxim Dounin]

Hello!

On Mon, Mar 28, 2016 at 03:54:40AM -0400, meteor8488 wrote:

> Hi All,
> 
> I'm using deny to deny some IPs for my server.
> 
> http {
>       deny 192.168.1.123; # this is an example
> 
> 
> 	server {
> 
> 		error_page  403 /error/403.htm;
> 		error_page  404 /error/404.htm;
> 		error_page  502 /error/502.htm;
> 		error_page  503 /error/503.htm;
> 
> 		location = /error/403.htm {
> 			index 403.htm;
> 			access_log /var/log/403.log  main;
> 		}
> 
> 		location ~* ^/(data|image)/.*.(php|php5)$ {
> 			deny all;
> 		}
> }
> 
> I found that if 192.168.1.123 access my server, due to this ip is blocked in
> http {}, so it will get a 500 response.
> And if someone (IP not blocked) try to access my data/*.php, he will get a
> 403 response.
> 
> And all these 500 and 403 response will be put into my 403.log.

That's because all of the requests are redirected /error/403.htm 
by the error_page directive, and you have logging to 403.log 
configured in the corresponding location.

The 500 error code is logged for requests from blocked IPs 
because:

- "deny" rule works in the location /error/403.htm, hence 403 
  error is triggered again;

- you have recursive_error_pages 
  (http://nginx.org/r/recursive_error_pages) enabled somewhere in your 
  configuration, and your configuration causes redirect loop which 
  in turn results in error 500 after 10 iterations.

To resolve the redirect loop, consider using "allow all" in the 
location /error/403.htm.

> Is it possible to put 500 response to a separate log? Then my 403 log will
> only log these who is trying to access the protected files.

Yes.  You can configure different error pages for protected files 
and the rest of the site, and log them separately.  E.g.:

    deny 192.168.1.123;

    error_page 403 /error/403.nolog.htm;

    location = /error/403.htm {
        allow all;
        access_log /path/to/403.log;
    }

    location = /error/403.nolog.htm {
        allow all;
        alias /error/403.htm;
        access_log off;
    }

    location /protected/ {
        deny all;
        error_page 403 /error/403.htm;
    }

> I understand that if I put "deny IP" in to server {}, it will get a 403
> response. But I want to deny some IPs on the whole server level. 

No, there is no difference between "deny" specified at http{} or 
server{} level.

-- 
Maxim Dounin
http://nginx.org/