0

I have an Nginx server that works as an SSL proxy for a service running on a localhost that doesn't support SSL authentication.

I would like to use Nginx's limit_req_zone function to protect the Basic_Auth against brute force attacks. There is a similar question with the answer to use Fail2ban, but I would like to use limit_req_zone if possible.

I've got it working - It is done using these two lines of code:

http {
  limit_req_zone $binary_remote_addr zone=one:10m rate=30r/m; # only one login in 2 seconds allowed
  ...

  location / {
    limit_req zone=one burst=5 nodelay; # only five connections allowed for the whole / root
    ...
    proxy_pass      http://127.0.0.1:2222/myapp/www/; # redirections to my unauthenticated service
  }
}

The problem is it also blocks number of requests when user is authenticated which results in fact, that http://127.0.0.1:2222/myapp/www/ is not fully loaded.

What location directive should I use to block only number of attempts to use Basic_Auth?

  • 2
    Now you know why you were recommended to use fail2ban. – Michael Hampton Sep 26 '14 at 14:06
  • So there is no way to use only limit_req_zone? Just blocking access to Basic_Auth index file or passwords file? – Joudicek Jouda Sep 26 '14 at 15:11
1

You can set some secret cookie header after authorisation. And block only requiress without the "secret cookie"

http {

    map $cookie_SECRET_NAME $is_limited{
        default $binary_remote_addr;
        "SECRET_VALUE" "";
    }

    limit_req_zone $is_limited zone=one:10m rate=30r/m; # only one login in 2 seconds allowed
    ...

    location / {
        limit_req zone=one burst=5 nodelay; # only five connections allowed for the whole / root
        ...
        proxy_pass      http://127.0.0.1:2222/myapp/www/; # redirections to my unauthenticated service
    }
}

In php script you can add the cookie after first success login

<?php
setcookie("SECRET_NAME", "SECRET_VALUE");
?>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.