Nginx – Block bruteforce attempts with nginx & cloudflare without rate limiting

brute-force-attacksnginx

So I discovered servers trying to bruteforce my API so I want to block them…but my specific scenario made it difficult to work with common solutions found on the internet.

1) I don't want to just rate limit, if any IP attempts to authenticate with the API and fail more than X times in ~6 hours I want to block them. No answers anymore at all. Not even 429 replies

2) I'm using cloudflare, so I need to use the CF IP header

3) I can't block the traffic based on iptables or similar solutions, since the only IPs that talk to my server are cloudflare IPs

4) The API generates nginx errors if the authentication fails with 2: no such file or directory if that helps with something

Given my scenario, what are the possible solutions?

Best Answer

There are a few things you could do, you could farm out the task to Cloudflare before it even hits your network by developing a Cloudflare Worker monitoring for abuse: https://workers.cloudflare.com/

If you want to keep the monitoring on your end you should use the nginx Real IP module to make sure you have the right IPs in your logs, Cloudflare has instructions here: https://support.cloudflare.com/hc/en-us/articles/200170786-Restoring-original-visitor-IPs-Logging-visitor-IP-addresses-with-mod-cloudflare-

Once you have the users real IPs included in your access logs you can use a program such as fail2ban to either set a ban on Cloudflare side (using their API) or by maintaining a block list in nginx using the deny directive.

Related Solutions

Nginx – How to Reply with 200 Without Serving a File

Yes, you can

location / {
    return 200 'gangnam style!';
    # because default content-type is application/octet-stream,
    # browser will offer to "save the file"...
    # if you want to see reply in browser, uncomment next line 
    # add_header Content-Type text/plain;
}

Debian – Use iptables rate limiting to temporarily block FTP server brute-force attempts

iptables -A INPUT -p tcp -m state --state NEW --dport 21 -m recent --name ftpattack --set
iptables -A INPUT -p tcp --dport 21 -m state --state NEW -m recent --name ftpattack --rcheck --seconds 60 --hitcount 4 -j LOG --log-prefix 'FTP REJECT: '
iptables -A INPUT -p tcp --dport 21 -m state --state NEW -m recent --name ftpattack --rcheck --seconds 60 --hitcount 4 -j REJECT --reject-with tcp-reset

these rules near or at the top of your ruleset will allow only three connections to port 21, from any given IP address, in a rolling 60-second window. To allow n, use --hitcount n+1; to use a bigger window than 60 seconds, increase --seconds 60.

Best Answer

Related Solutions

Nginx – How to Reply with 200 Without Serving a File

Debian – Use iptables rate limiting to temporarily block FTP server brute-force attempts

Related Topic