Have you considered using something like mod_security to manage this sort of thing?
From: nginx [mailto:nginx-boun...@nginx.org] On Behalf Of Friscia, Michael Sent: Monday, March 19, 2018 9:17 AM To: nginx@nginx.org Subject: [IE] Re: Aborting malicious requests Thank you Gary, I really appreciate you moving me in the right direction. Sent from my iPhone with all its odd spell checks On Mar 19, 2018, at 9:36 AM, Gary <li...@lazygranch.com<mailto:li...@lazygranch.com>> wrote: Your basic idea is right, but what you want to do is use a "map." I will follow up with more details when I can pull the code off my server. I 444 a number of services that I don't use. I have a script to find the IP addresses of those that trigger a 444 from access.log. If they come from a data center, hosting service, etc., they get on a blocking list for my firewall. I block the entire IP space. From: michael.fris...@yale.edu<mailto:michael.fris...@yale.edu> Sent: March 19, 2018 5:31 AM To: nginx@nginx.org<mailto:nginx@nginx.org> Reply-to: nginx@nginx.org<mailto:nginx@nginx.org> Subject: Aborting malicious requests Just a thought before I start crafting one. I am creating a location{} block with the intention of populating it with a ton of requests I want to terminate immediately with a 444 response. Before I start, I thought I’d ask to see if anyone has a really good one I can use as a base. For example, we don’t serve PHP so I’m starting with Location ~* .php { Return 444; } Then I can just include this into all my server blocks so I can manage the aborts all in one place. This alone reduces errors in the logs significantly. But now I will have to start adding in all the wordpress stuff, then onto php myadmin, etc. I will end up with something like Location ~* (.php|wp-admin|my-admin) { Return 444; } I can imagine the chunk inside the parenthesis is going to be pretty huge which is why I thought I’d reach out to see if anyone has one already. Thanks, -mike ___________________________________________ Michael Friscia Office of Communications Yale School of Medicine (203) 737-7932<tel:(203)7377932> - office (203) 931-5381<tel:(203)9315381> - mobile http://web.yale.edu<http://web.yale.edu/> _______________________________________________ nginx mailing list nginx@nginx.org<mailto:nginx@nginx.org> https://urldefense.proofpoint.com/v2/url?u=http-3A__mailman.nginx.org_mailman_listinfo_nginx&d=DwICAg&c=cjytLXgP8ixuoHflwc-poQ&r=wvXEDjvtDPcv7AlldT5UvDx32KXBEM6um_lS023SJrs&m=MMFd1g-YpouXJolEFUG9wADYPEA1sPlvQ_GvUe4zJHk&s=JRurMbCby9FTsTmkiXgHZcPzDsixrqBHKRyZb2qSny4&e= This message contains proprietary information from Equifax which may be confidential. If you are not an intended recipient, please refrain from any disclosure, copying, distribution or use of this information and note that such actions are prohibited. If you have received this transmission in error, please notify by e-mail postmas...@equifax.com. Equifax® is a registered trademark of Equifax Inc. All rights reserved.
_______________________________________________ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx
