Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a nginx proxy facing public internet. A few days ago, I started to receive a torrential amount of requests, targeting URLs that are invalid for my domain.

An excerpt from nginx access.log:

216.245.222.172 - - [07/Feb/2014:10:45:26 +0000] "GET http://ads.yahoo.com/st?ad_type=iframe&ad_size=300x250&section=5306841&pub_url=${PUB_URL} HTTP/1.0" 301 184 "http://www.echogap.com/index.php?option=com_content&view=article&id=1383:Credit-Report---How-Do-Late-Payments-Affect-My-Credit-Report-And-Score?&catid=154" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/125.2 (KHTML, like Gecko) Safari/125.8"

Some points I need help understanding / solving:

  • Why does the request url contains the full url with domain name, instead of the usual path only ?
  • How is it possible that requests that are not even targeting my domain reaches my server (.i.e, ads.yahoo.com) ?
  • What would be the best way to avoid serving these requests ? I guess blacklisting the originated ips is out of question, since the requests come from a LOT of different addresses.
  • Does the described scenario mean an explicit attack ?
share|improve this question

1 Answer 1

up vote 7 down vote accepted

It seems like they are trying to use your web server as an open proxy. As long as you don't see your servers responding with a 200 OK, you shouldn't be worried.

UPDATE:

Although there may be ways to handle this with builtin nginx functionality, I found easier to install/enable mod_security and let him handle this and other nasty attacks. As you'll see in the logs below, somebody is trying to reach wikipedia through my server, mod_security knows that this this is an anomaly an takes an appropriate action (It returns a 403 forbidden response). This is an Apache server but it should be exactly the same in nginx.

--817ee627-A--
[03/Feb/2014:22:26:01 +0300] Uu-tScDjiOsAAALeENQAAAAA 178.19.107.26 52735 1.2.3.4 80
--817ee627-B--
GET http://wikipedia.pl HTTP/1.1
Host: wikipedia.pl
Accept: */*
Proxy-Connection: Keep-Alive

--817ee627-F--
HTTP/1.1 403 Forbidden
Content-Length: 202
Connection: close
Content-Type: text/html; charset=iso-8859-1

--817ee627-E--

--817ee627-H--
Message: Access denied with code 403 (phase 1). Match of "rx ^(?i:(?:[a-z]{3,10}\\s+(?:\\w{3,7}?://[\\w\\-\\./]*(?::\\d+)?)?/[^?#]*(?:\\?[^#\\s]*)?(?:#[\\S]*)?|connect (?:\\d{1,3}\\.){3}\\d{1,3}\\.?(?::\\d+)?|options \\*)\\s+[\\w\\./]+|get /[^?#]*(?:\\?[^#\\s]*)?(?:#[\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/httpd/modsecurity.d/activated_rules/modsecurity_crs_20_protocol_violations.conf"] [line "52"] [id "960911"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "GET http://wikipedia.pl HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/2.2.6"] [maturity "9"] [accuracy "9"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"]
Action: Intercepted (phase 1)
Stopwatch: 1391455561096692 260049 (- - -)
Stopwatch2: 1391455561096692 260049; combined=104238, p1=104194, p2=0, p3=0, p4=0, p5=43, sr=104028, sw=1, l=0, gc=0
Response-Body-Transformed: Dechunked
Producer: ModSecurity for Apache/2.7.3 (http://www.modsecurity.org/); OWASP_CRS/2.2.6.
Server: Apache
Engine-Mode: "ENABLED"

*1.2.3.4 = I replaced my IP address with this fake IP. I don't need any more strange packets knocking my door :)

share|improve this answer
    
Thanks for pointing out Gabriel. Researching on a solution on "how to avoid being an open proxy" I stumbled upon the valid_referers nginx directive. The way I see it, returning 403 instead of 302 on these hop-requests should make my server less appropriate for the job of being an open proxy, and maybe stop being used as such at all (please correct me if I am wrong). –  ccortezia Feb 8 at 20:52
    
Anyway, I cannot mark your answer right just yet. Some points raised on the question are still opened. Let's wait a bit longer. –  ccortezia Feb 8 at 20:53
    
You are correct, returning 403 will be the safer way to handle this. Please see the update in my reply. –  Gabriel Talavera Feb 8 at 21:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.