Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My server is under a heavy attack. Most requests are coming this way:

46.43.84.214 - - [15/May/2012:11:21:45 +0400] "GET / HTTP/1.0" 200 65859 "2r4k68998q24ay.ru" "Mozilla/4.0 (compatible; MSIE 4.01; Vonna.com b o t)"

The HTTP protocol version is same for all such requests. Can I block HTTP 1.0 requests on a web server level somehow? I have tried this to eliminate the attack (redirect to an empty file):

if ($server_protocol ~* "HTTP/1.0") {
    rewrite ^/ http://example.com/white.txt;
}

Does not seem to help much, I don't see any such redirects in the logs. I use nginx 1.0.9 as a reverse proxy with Apache 2.2.3.

Any help is appreciated.

share|improve this question

2 Answers 2

up vote 4 down vote accepted

You could use something like this

if ($http_user_agent ~* "Vonna.com" ) {
    return 444;
} 

444 will close the connection without returning anything, assuring the lowest possible impact. Though if you want to inform possible legitimate users, use something like 400 perhaps.

Additionally, perhaps block by referrer, though most bots will easily spoof that too.

As far as blocking entire HTTP 1.0 is concerned, you should check this first. If you'd still like to implement the block as a temporary solution, something like this should work.

if ($server_protocol ~* "HTTP/1.0") {
    return 444;
} 

Basically the same thing you had, except with no rewrite - if I'm reading it right, your usage made it just stay in a permanent loop.

share|improve this answer
    
But they send all requests with a uniq user agent header. What do I do on this matter? You advice is very promising. –  Andrew May 15 '12 at 8:09
    
You can download it here: dl.dropbox.com/u/17184781/down/nginx.conf. That you very much. –  Andrew May 15 '12 at 8:49
    
Fixed up the answer so it actually makes sense. But still, take blocking HTTP 1.0 as the last resort, any only temporary, since there's a chance you might block normal users, as low as it is. Rather identify recurring/related source IPs/user agents/referrers and block on that. –  Sašo May 15 '12 at 9:15
    
Thank you. Yes, it will be a permanent block, of course. –  Andrew May 15 '12 at 9:29

Use the right variable: $server_protocol instead of $http_user_agent.

share|improve this answer
    
Thanks, but it was just a typo. I've corrected my original post. –  Andrew May 15 '12 at 8:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.