1

My webserver (nginx) keeps getting requests like this: 

23.244.104.206 - - [15/Jun/2014:21:21:47 -0400] "GET http://ib.adnxs.com/ttj?id=2947236&size=300x250&cb={CACHEBUSTER}&referrer={REFERRER_URL}&pubclick={INSERT_CLICK_TAG} HTTP/1.0" 200 612 "http://www.businessfull.net/?p=8167" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; de-de) AppleWebKit/534.15+ (KHTML, like Gecko) Version/5.0.3 Safari/533.19.4"
216.244.65.21 - - [15/Jun/2014:21:21:47 -0400] "GET http://ib.adnxs.com/ttj?id=2583052&referrer=http%3A%2F%2Fwww.excitingflashgames.com%2Fgame%2Frun_chicken_run.html&cb=78488 HTTP/1.0" 200 612 "http://www.excitingflashgames.com/game/run_chicken_run.html" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.2 (KHTML, like Gecko) Ubuntu/11.04 Chromium/15.0.871.0 Chrome/15.0.871.0 Safari/535.2"

There are hunderds of these requests and they cause my http server to be a lot slower. Is there some way I can block this using iptables? The weird this is that they are trying to visit sites that I don't even host. I thought this would be usefull in banning them but I'm not sure how I would do that.

kasperd
  • 30,696
AliceDTRH
  • 15
  • Haven't used nginx as a web server yet, but maybe you can do something with it if you're just dealing with a hundreds? i don't like to question the scalability of nginx but with 'hundreds' affecting the performance of your web server, i just can't. –  Jun 16 '14 at 02:47

3 Answers3

8

This is an example of a well known proxy abuse exploit. Some versions of Apache (which have the proxy module installed) are often are left improperly configured or not secured, and allow anybody to route a request through your webserver, in effect, turning it into an unwitting and illicit proxy server (which could be used in an unpleasant attack).

Although tomtom recommends offloading your security to CloudFlare, the solution is fairly simple, and should be implemented as a part of any basic security audit (even for the most basic of websites).

Building on Vinícius Ferrão's answer; After you install Fail2Ban, you will need to setup a filter (on debian/ubuntu, create the file /etc/fail2ban/filter.d/nginx-proxy.conf).

In this file, enter this:

# Block IPs trying to use server as proxy.
#
# Matches e.g.
# 192.168.1.1 - - "GET http://www.something.com/
#
[Definition]
failregex = ^<HOST> -.*GET http.*
ignoreregex =

and then create this block inside the fail2ban configuration file (usually under /etc/fail2ban/jail.conf):

## block hosts trying to abuse our server as a forward proxy
[nginx-proxy]
enabled = true
port    = 80,443
filter = nginx-proxy
logpath = /path/to/websites/access.log.file
maxretry = 2
bantime  = 86400

(replacing logpath = with the path to the access log of your website)

This will use the default blocking mode to ban hosts trying to abuse your site as a forward proxy.

Afterwards, I would consider checking your nginx configuration, and use controls to prevent anybody from making these requests to your server (if not from a specific IP).

Hope this helps!

RapidWebs
  • 571
  • 2
    Not only did your answer solve my current problem, it will also solve any future problems because of the awesome examples in your post. Thank you! – AliceDTRH Jun 18 '14 at 00:43
  • glad I could help! :) – RapidWebs Jun 18 '14 at 19:49
  • if you do use cloudflare, you also need to configure nginx or a firewall to only allow connections from cloudflare. at the moment, my server IP is being used so cloudflare isn't proxying the attack – Jayen Nov 17 '22 at 13:02
5

This should not be the case, but if you're getting a lot of requests from the same source constantly and this is causing a Denial of Service (DoS) on your server you should consider using something like fail2ban to temporally ban abusive clients from your server.

Anyway it's a good idea to avoid bruteforce attacks for example, if you don't have some security appliance before your final destination (your server).

You can get more information about fail2ban on it's website: http://www.fail2ban.org and there are some configuration tips to use fail2ban with nginx over here: http://www.fail2ban.org/wiki/index.php/NginX

Vinícius Ferrão
  • 5,620
0

Welcome to the internet. Where bots galore try finding exploits in every server connected.

Live with it. There is nothing you sensibly CAN do.

There are hunderds of these requests and they cause my server to be a lot slower.

You run your server on like 50 year old hardware=? because even the smallest VPS would not really bulget and get a lot slower with hundreds such requests per second.

TomTom
  • 51,864
  • 7
  • 55
  • 136
  • I meant my http server, not my entire server. I edited the question. – AliceDTRH Jun 16 '14 at 02:29
  • 1
    Irrelevant. The statement stands. The traffic should not matter at all. Not even on my phone. – TomTom Jun 16 '14 at 02:48
  • 1
    @HiddenKnowledge TomTom's cell phone runs a webserver capable of hosting some pretty decent websites. It's well documented. Regardless of his phone your webserver shouldn't even notice a few hundred requests unless someone is off. Vinicius has a great answer for the most basic defenses (mainly the evey popular fail2ban). – Chris S Jun 16 '14 at 03:15
  • Actually there is a better defence - do not defend at all ON YOUR SERVER. Use CLoudFlare to proxy your traffic. More speed and tehy handle all the crap requests.... for free. – TomTom Jun 16 '14 at 03:38
  • 3
    in my opinion, leaving your server or infrastructure insecure, and offloading it on to somebody or someone else is not a valid (or responsible) response. furthermore, there are circumstances where this can interfere with treating a real attack, due to having messy and complex logs to sift through. moreover, as a website becomes more popular, it gets more traffic, and more bots hit your server. if this is causing slowness now, it will grow exponentially. therefore, implementing the simple fix should be done now, rather than later. – RapidWebs Jun 16 '14 at 04:58
  • Yes and no. See, the issue is that CLoudFlare does a lot more.... including offloading your COST through their nice automatic CDN. – TomTom Jun 16 '14 at 05:50
  • The main reason I do not want to use Cloudflare is because, in order to get SSL I'd have to pay 20$ per month and because it doesn't fix the actual problem. It also means my site is completely in the hands of Cloudflare, so if their server goes down so does my website (and yes, this happens). – AliceDTRH Jun 16 '14 at 15:59
  • Actually their serverS. I use them because at the end they save me a lot of money.... via bandwidth savings and they reduce my attack surface (as my servers are hidden then). – TomTom Jun 16 '14 at 16:18