Home / user-143330

hardillb's questions

Martin Hope
hardillb
Asked: 2020-07-17 04:09:06 +0800 CST
  • 1

I recently updated the settings on a public facing NGINX instance to add support for http2. While looking at the logs afterwards to get feel for how often it was being used I saw rapid rise in new log entries not related to site hosted.

First were a bunch of entries making CONNECT requests, these are all failing with 400 errors because the NGINX instance is not configured as a forward proxy. I've set up fail2ban rules to drop traffic from the many source IP addresses. I'm not particularly worried about this (please add a comment if I should be).

The next set of entries are GET requests but rather than having paths, they have full URLs as the target e.g.

222.223.121.231 - - [16/Jul/2020:12:57:37 +0100] "GET http://api.gxout.com/proxy/check.aspx HTTP/1.1" 404 199 "http://api.gxout.com/proxy/check.aspx" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"

Most of these are getting 404 responses again as expected and I've added another fail2ban rule to drop packets from the source IP addresses (again not really bothered about these).

There are some more similar that are getting 200 responses and these are the ones I'm worried about e.g.

35.236.60.202 - - [16/Jul/2020:11:52:28 +0100] "GET http://www.nike.com/ HTTP/1.1" 200 396 "-" "python-requests/2.20.0"

I have the following questions:

  1. Why would NGINX return a 200 for this request?
  2. Suggestions for how to debug this?

All the incoming traffic should be https (required or http2) and I'm pinned at TLS 1.2 or 1.3 so I don't think capturing the traffic with tcpdump is going to help (I'm assuming I can't feed the private key into wireshark and decode the packets?).

The only other option I can think of is adding some custom logging (Is it possible to log the response data in nginx access log?) to the NGINX to log the whole request/response. I've done this in the past to debug oAuth2.0 token exchange issues but only on a system where I had full control over all the incoming traffic.

nginx
Martin Hope
hardillb
Asked: 2019-08-06 15:34:28 +0800 CST
  • 3

I have a domain entry in my DNS with 3 different TXT records (1 SPF, 1 Keybase proof and a DMARC entry).

I'm about to move my mail server to a new host so need to update the SPF record but I'm struggling to work out how to remove and replace just the SPF record with nsupdate.

At the moment the best option I can come up with is to script nsupdate to remove all 3 and add the 2 unchanged ones back before adding the updated SPF record.

Is there a way to just remove the 1 record?

bind
Martin Hope
hardillb
Asked: 2015-12-26 10:37:42 +0800 CST
  • 2

I'm playing with DNSSEC for my domain, my DNS server is dual homed (with suitable limits on what can be queried on the public interface) and covers both my public domain, but also a private top level domain (.loc) that I use on my LAN.

I'm struggling to work out how to add a DS record for the .loc domain into my bind9 config. Because it is a Top Level Domain it would normally be listed root servers.

Can I add it to my zone file before the $ORIGIN statement?

bind