Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is there an application that goes through the nginx logs and blocks IPs that made requests for common webapp vulnerabilities?

I have an nginx web server that serves only static content. I routinely get requests for GET /db/websql/main.php or GET /db/phpMyAdmin2/main.php. Those are clear signs of somebody scanning for vulnerabilities. Is there an application that can go through the nginx logs, recognize these attempts to exploit common vulnerabilities and block the offending IPs? My idea is that, even if I am not vulnerable to those exploits, the same IPs could engage in other kinds of attacks on the same box or other boxes on my network: SMTP, SSH, other web servers with web applications. Blocking them while caught with their hands in the cookie jar seems a good approach to me.

Fail2ban does something similar for SSH and for HTTP authentication attempts. Maybe it could be used with a configuration that includes a list of well-known addresses used for vulnerabilities. Is there such a configuration available?

share|improve this question

2 Answers 2

From the gotroot.com forums:

You can use nginx with our rules by putting a reverse proxy apache with mod_security in front of nginx. Thats actually very lightweight and something we will be adding post 3.0 as an option for sites running alternative web servers like nginx, etc. As Scott said, nginx does not have any WAF module or capability, so theres no way you can do anything like modsecurity inside nginx.

People have requested the nginx team add a WAF, and I know lightspeed is working on full modsec support, but so far I havent seen anything for nginx. So if you use nginx, and you want a WAF to protect it, you will need to put a WAF in front of it.

And as I said, this works great so I highly recommend you do that. We've got a bunch of customers running all sorts of non-apache webservers with apache reverse proxies and mod_security in front of them. And as I mentioned, we will be adding this into ASL post 3.0 release as an option for non-Apache web servers.

(Gotroot.com is well-known for their mod_security rules list they provide.)

Another thing you can try is naxsi which is a Web Application Firewall module for Nginx, although it's still in alpha version. More

share|improve this answer
    
If use an alternative webserver like nginx is probably because I don't want to use Apache. –  Giovanni Toraldo Sep 30 '11 at 10:17
    
Who said you should run Apache as a webserver? You're just using it as a reverse proxy in front of nginx to handle the lack of mod_security on the latter. Anyway another solution might be Naxsi code.google.com/p/naxsi which is a Web Application Firewall module for Nginx. Have a look at it and see if it fits your needs. –  George Tasioulis Sep 30 '11 at 10:38

How are you spotting these illegal requests... if you can see them then fail2ban can see them. Its just a case of adding rules in the jail.conf to spot these and then ban these users.

Create a copy of the apache-httpd code in fail2ban and have a play with it. You basically need to figure out the regex to match each error that you get, and then tell fail2ban what to do about it.

share|improve this answer
    
I agree with you, fail2ban could do that. As I said, what I need is «a configuration that includes a list of well-known addresses used for vulnerabilities». I know some, but I am not an expert and I have the resources and the knowledge necessary to keep it updated. Do you know any of these lists available as fail2ban configuration file? –  gioele Sep 30 '11 at 12:07
1  
Fail2ban doesn't use a list - it looks for errors. These common pages don't exist on your server, so it causes a 404 error in your logs. Enough of these 404s show someone is trying something untowards, so you ban them. –  djsmiley2k Oct 10 '11 at 14:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.