Aborting malicious requests

[Jason Whittington]

Have you considered using something like mod_security to manage this sort of thing?

From: nginx [mailto:nginx-bounces at nginx.org] On Behalf Of Friscia, Michael
Sent: Monday, March 19, 2018 9:17 AM
To: nginx at nginx.org
Subject: [IE] Re: Aborting malicious requests

Thank you Gary, I really appreciate you moving me in the right direction.
Sent from my iPhone with all its odd spell checks

On Mar 19, 2018, at 9:36 AM, Gary <lists at lazygranch.com<mailto:lists at lazygranch.com>> wrote:
Your basic idea is right, but what you want to do is use a "map." I will follow up with more details when I can pull the code off my server.

I 444 a number of services that I don't use. I have a script to find the IP addresses of those that trigger a 444 from access.log. If they come from a data center, hosting service, etc., they get on a blocking list for  my firewall. I block the entire IP space.

From: michael.friscia at yale.edu<mailto:michael.friscia at yale.edu>
Sent: March 19, 2018 5:31 AM
To: nginx at nginx.org<mailto:nginx at nginx.org>
Reply-to: nginx at nginx.org<mailto:nginx at nginx.org>
Subject: Aborting malicious requests


Just a thought before I start crafting one. I am creating a location{} block with the intention of populating it with a ton of requests I want to terminate immediately with a 444 response. Before I start, I thought I’d ask to see if anyone has a really good one I can use as a base.

For example, we don’t serve PHP so I’m starting with
Location ~* .php {
Return 444;
}

Then I can just include this into all my server blocks so I can manage the aborts all in one place. This alone reduces errors in the logs significantly. But now I will have to start adding in all the wordpress stuff, then onto php myadmin, etc. I will end up with something like

Location ~* (.php|wp-admin|my-admin) {
Return 444;
}

I can imagine the chunk inside the parenthesis is going to be pretty huge which is why I thought I’d reach out to see if anyone has one  already.

Thanks,
-mike

___________________________________________
Michael Friscia
Office of Communications
Yale School of Medicine
(203) 737-7932<tel:(203)7377932> - office
(203) 931-5381<tel:(203)9315381> - mobile
http://web.yale.edu<http://web.yale.edu/>

_______________________________________________
nginx mailing list
nginx at nginx.org<mailto:nginx at nginx.org>
https://urldefense.proofpoint.com/v2/url?u=http-3A__mailman.nginx.org_mailman_listinfo_nginx&d=DwICAg&c=cjytLXgP8ixuoHflwc-poQ&r=wvXEDjvtDPcv7AlldT5UvDx32KXBEM6um_lS023SJrs&m=MMFd1g-YpouXJolEFUG9wADYPEA1sPlvQ_GvUe4zJHk&s=JRurMbCby9FTsTmkiXgHZcPzDsixrqBHKRyZb2qSny4&e=
This message contains proprietary information from Equifax which may be confidential. If you are not an intended recipient, please refrain from any disclosure, copying, distribution or use of this information and note that such actions are prohibited. If you have received this transmission in error, please notify by e-mail postmaster at equifax.com. Equifax® is a registered trademark of Equifax Inc. All rights reserved.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20180319/ecb02dfe/attachment.html>