From b5af68a3a0866687666f184e3feca4e3af643f12 Mon Sep 17 00:00:00 2001 From: ChiefGyk Date: Sat, 17 Dec 2016 15:35:03 -0500 Subject: [PATCH 1/2] added some nginx exploit protections from https://www.howtoforge.com/nginx-how-to-block-exploits-sql-injections-file-injections-spam-user-agents-etc --- conf/nginx.conf | 234 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 234 insertions(+) diff --git a/conf/nginx.conf b/conf/nginx.conf index 0a08439e..937c0341 100644 --- a/conf/nginx.conf +++ b/conf/nginx.conf @@ -27,6 +27,121 @@ server { # tool knows to store challenge response files. alias $STORAGE_ROOT/ssl/lets_encrypt/acme_challenges/; } + + ## Block SQL injections + set $block_sql_injections 0; + if ($query_string ~ "union.*select.*\(") { + set $block_sql_injections 1; + } + if ($query_string ~ "union.*all.*select.*") { + set $block_sql_injections 1; + } + if ($query_string ~ "concat.*\(") { + set $block_sql_injections 1; + } + if ($block_sql_injections = 1) { + return 403; + } + + ## Block file injections + set $block_file_injections 0; + if ($query_string ~ "[a-zA-Z0-9_]=http://") { + set $block_file_injections 1; + } + if ($query_string ~ "[a-zA-Z0-9_]=(\.\.//?)+") { + set $block_file_injections 1; + } + if ($query_string ~ "[a-zA-Z0-9_]=/([a-z0-9_.]//?)+") { + set $block_file_injections 1; + } + if ($block_file_injections = 1) { + return 403; + } + + ## Block common exploits + set $block_common_exploits 0; + if ($query_string ~ "(<|%3C).*script.*(>|%3E)") { + set $block_common_exploits 1; + } + if ($query_string ~ "GLOBALS(=|\[|\%[0-9A-Z]{0,2})") { + set $block_common_exploits 1; + } + if ($query_string ~ "_REQUEST(=|\[|\%[0-9A-Z]{0,2})") { + set $block_common_exploits 1; + } + if ($query_string ~ "proc/self/environ") { + set $block_common_exploits 1; + } + if ($query_string ~ "mosConfig_[a-zA-Z_]{1,21}(=|\%3D)") { + set $block_common_exploits 1; + } + if ($query_string ~ "base64_(en|de)code\(.*\)") { + set $block_common_exploits 1; + } + if ($block_common_exploits = 1) { + return 403; + } + + ## Block spam + set $block_spam 0; + if ($query_string ~ "\b(ultram|unicauca|valium|viagra|vicodin|xanax|ypxaieo)\b") { + set $block_spam 1; + } + if ($query_string ~ "\b(erections|hoodia|huronriveracres|impotence|levitra|libido)\b") { + set $block_spam 1; + } + if ($query_string ~ "\b(ambien|blue\spill|cialis|cocaine|ejaculation|erectile)\b") { + set $block_spam 1; + } + if ($query_string ~ "\b(lipitor|phentermin|pro[sz]ac|sandyauer|tramadol|troyhamby)\b") { + set $block_spam 1; + } + if ($block_spam = 1) { + return 403; + } + + ## Block user agents + set $block_user_agents 0; + + # Don't disable wget if you need it to run cron jobs! + #if ($http_user_agent ~ "Wget") { + # set $block_user_agents 1; + #} + + # Disable Akeeba Remote Control 2.5 and earlier + if ($http_user_agent ~ "Indy Library") { + set $block_user_agents 1; + } + + # Common bandwidth hoggers and hacking tools. + if ($http_user_agent ~ "libwww-perl") { + set $block_user_agents 1; + } + if ($http_user_agent ~ "GetRight") { + set $block_user_agents 1; + } + if ($http_user_agent ~ "GetWeb!") { + set $block_user_agents 1; + } + if ($http_user_agent ~ "Go!Zilla") { + set $block_user_agents 1; + } + if ($http_user_agent ~ "Download Demon") { + set $block_user_agents 1; + } + if ($http_user_agent ~ "Go-Ahead-Got-It") { + set $block_user_agents 1; + } + if ($http_user_agent ~ "TurnitinBot") { + set $block_user_agents 1; + } + if ($http_user_agent ~ "GrabNet") { + set $block_user_agents 1; + } + + if ($block_user_agents = 1) { + return 403; + } } # The secure HTTPS server. @@ -44,4 +159,123 @@ server { ssl_certificate_key $SSL_KEY; # ADDITIONAL DIRECTIVES HERE + ## Additional Exploit blocks added by Alon Ganon + # alon@ganon.me https://alonganon.info + # Recommended from here https://www.howtoforge.com/nginx-how-to-block-exploits-sql-injections-file-injections-spam-user-agents-etc + ## Block SQL injections + set $block_sql_injections 0; + if ($query_string ~ "union.*select.*\(") { + set $block_sql_injections 1; + } + if ($query_string ~ "union.*all.*select.*") { + set $block_sql_injections 1; + } + if ($query_string ~ "concat.*\(") { + set $block_sql_injections 1; + } + if ($block_sql_injections = 1) { + return 403; + } + + ## Block file injections + set $block_file_injections 0; + if ($query_string ~ "[a-zA-Z0-9_]=http://") { + set $block_file_injections 1; + } + if ($query_string ~ "[a-zA-Z0-9_]=(\.\.//?)+") { + set $block_file_injections 1; + } + if ($query_string ~ "[a-zA-Z0-9_]=/([a-z0-9_.]//?)+") { + set $block_file_injections 1; + } + if ($block_file_injections = 1) { + return 403; + } + + ## Block common exploits + set $block_common_exploits 0; + if ($query_string ~ "(<|%3C).*script.*(>|%3E)") { + set $block_common_exploits 1; + } + if ($query_string ~ "GLOBALS(=|\[|\%[0-9A-Z]{0,2})") { + set $block_common_exploits 1; + } + if ($query_string ~ "_REQUEST(=|\[|\%[0-9A-Z]{0,2})") { + set $block_common_exploits 1; + } + if ($query_string ~ "proc/self/environ") { + set $block_common_exploits 1; + } + if ($query_string ~ "mosConfig_[a-zA-Z_]{1,21}(=|\%3D)") { + set $block_common_exploits 1; + } + if ($query_string ~ "base64_(en|de)code\(.*\)") { + set $block_common_exploits 1; + } + if ($block_common_exploits = 1) { + return 403; + } + + ## Block spam + set $block_spam 0; + if ($query_string ~ "\b(ultram|unicauca|valium|viagra|vicodin|xanax|ypxaieo)\b") { + set $block_spam 1; + } + if ($query_string ~ "\b(erections|hoodia|huronriveracres|impotence|levitra|libido)\b") { + set $block_spam 1; + } + if ($query_string ~ "\b(ambien|blue\spill|cialis|cocaine|ejaculation|erectile)\b") { + set $block_spam 1; + } + if ($query_string ~ "\b(lipitor|phentermin|pro[sz]ac|sandyauer|tramadol|troyhamby)\b") { + set $block_spam 1; + } + if ($block_spam = 1) { + return 403; + } + + ## Block user agents + set $block_user_agents 0; + + # Don't disable wget if you need it to run cron jobs! + #if ($http_user_agent ~ "Wget") { + # set $block_user_agents 1; + #} + + # Disable Akeeba Remote Control 2.5 and earlier + if ($http_user_agent ~ "Indy Library") { + set $block_user_agents 1; + } + + # Common bandwidth hoggers and hacking tools. + if ($http_user_agent ~ "libwww-perl") { + set $block_user_agents 1; + } + if ($http_user_agent ~ "GetRight") { + set $block_user_agents 1; + } + if ($http_user_agent ~ "GetWeb!") { + set $block_user_agents 1; + } + if ($http_user_agent ~ "Go!Zilla") { + set $block_user_agents 1; + } + if ($http_user_agent ~ "Download Demon") { + set $block_user_agents 1; + } + if ($http_user_agent ~ "Go-Ahead-Got-It") { + set $block_user_agents 1; + } + if ($http_user_agent ~ "TurnitinBot") { + set $block_user_agents 1; + } + if ($http_user_agent ~ "GrabNet") { + set $block_user_agents 1; + } + + if ($block_user_agents = 1) { + return 403; + } + + } From 1fb3434ff5e82ea57e907b9cb555250f84cd7d0f Mon Sep 17 00:00:00 2001 From: ChiefGyk Date: Sat, 17 Dec 2016 15:43:03 -0500 Subject: [PATCH 2/2] added some DDoS protection referenced from https://easyengine.io/tutorials/nginx/fail2ban/ adding a new Fail2Ban filter dubbed nginx-req-limit --- conf/fail2ban/filter.d/nginx-req-limit.conf | 13 +++++++++++++ conf/fail2ban/jails.conf | 9 +++++++++ 2 files changed, 22 insertions(+) create mode 100644 conf/fail2ban/filter.d/nginx-req-limit.conf diff --git a/conf/fail2ban/filter.d/nginx-req-limit.conf b/conf/fail2ban/filter.d/nginx-req-limit.conf new file mode 100644 index 00000000..fb1b70a7 --- /dev/null +++ b/conf/fail2ban/filter.d/nginx-req-limit.conf @@ -0,0 +1,13 @@ +# Fail2Ban configuration file +# +# supports: ngx_http_limit_req_module module + +[Definition] + +failregex = limiting requests, excess:.* by zone.*client: + +# Option: ignoreregex +# Notes.: regex to ignore. If this regex matches, the line is ignored. +# Values: TEXT +# +ignoreregex = \ No newline at end of file diff --git a/conf/fail2ban/jails.conf b/conf/fail2ban/jails.conf index 0146b64c..7a88229a 100644 --- a/conf/fail2ban/jails.conf +++ b/conf/fail2ban/jails.conf @@ -78,3 +78,12 @@ bantime = 3600 [ssh-ddos] enabled = true + +[nginx-req-limit] + +enabled = true +filter = nginx-req-limit +action = iptables-multiport[name=ReqLimit, port="http,https", protocol=tcp] +logpath = /var/log/nginx/*error.log +findtime = 600 +bantime = 7200