Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

On the past few hours my server is getting pretty loaded, mostly due to a lot of load requests. I've seen this thanks to the StatCounter realtime stats, which shows that the "Came from" page is:

http://www.facebook.com/extern/login_status.php?api_key=3d34061e0ac6dc4dec21b35d2fb9d6d3&extern=0&channel=http%3A%2F%2Fwww.mysite.com%2F%3Fxd_receiver%3D1&locale=es_ES&sdk=edgar

And the Landing Page is

http://www.mysite.com/?xd_receiver=1#%7B%22id%22%3A0%2C%22sc%22%3A%22http%3A%2F%2Fwww.facebook.com%2Fxd_receiver_v0.4.php%22%2C%22sf%22%3A%22loginStatus%22%2C%22sr%22%3A2%2C%22h%22%3A%22loginServer%22%2C%22sid%22%3A%220.162%22%2C%22t%22%3A0%7D%5B0%2C%22loginStatus%22%2C%22InitLogin%22%2C%7B%22b

The CPU, mem and bandwidth are getting higher and higher, and I'd like to now if this could be some sort of attack.

This is a WordPress blog with WP 3.2.1, based on an Ubuntu 10.04.2 LTS, with Nginx, PHP-FPM and APC. Usually it runs pretty well, but I'm affraid this requests are loading the server to much.

The only explanation I have is that I've got the Simple Facebook Connect plugin to allow comments with a Facebook account, but it hasn't give any problems until now.

The strange thing is, the access.log shows the requests come from different IPs, so I guess it's not an attack

164.77.106.237 - - [19/Oct/2011:18:20:53 +0200] "GET /?xd_receiver=1 HTTP/1.1" 403 189 "http://www.facebook.com/extern/login_status.php?api_key=3d34061e0ac6dc4dec21b35d2fb9d6d3&extern=0&channel=http%3A%2F%2Fwww.mysite.com%2F%3Fxd_receiver%3D1&locale=es_ES&sdk=edgar" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.1)"
212.104.164.139 - - [19/Oct/2011:18:20:48 +0200] "GET /?xd_receiver=1 HTTP/1.1" 403 135 "http://www.facebook.com/extern/login_status.php?api_key=3d34061e0ac6dc4dec21b35d2fb9d6d3&extern=0&channel=http%3A%2F%2Fwww.mysite.com%2F%3Fxd_receiver%3D1&locale=es_ES&sdk=edgar" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1"

etc.

Is it possible in Nginx to block URLs for example that match the api_key parameter that is a constant in all these requests?

share|improve this question
2  
It isn't worth thinking about blocking. The "visitors" get a 403 error and that's it. No problem. Go ahead. –  mailq Oct 19 '11 at 16:38
    
Yes, but anyway I'd like to know if I can block them straight away with some kind of nginx parameter. The requests keep on producing high load... –  javipas Oct 20 '11 at 8:01

1 Answer 1

up vote 3 down vote accepted

Yes, you can block an url in NGINX with regex like this:

location / {
    if ($uri ~* '^/(abc|def|ghi)$') {
         allow 1.2.3.4;
         deny all;
    }
    root  /var/www/
    ...
}

You can also block some referers:

if ($http_referer ~* (klm|nop|qrs)) {
    return 403;
}

Or user agent:

if ($http_user_agent ~ (libwww-perl|wget) ) {
    return 403;
}
share|improve this answer
1  
Thanks, I blocked the referrer and it seems the problem dissapeared –  javipas Nov 7 '11 at 12:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.