long live return code 444

Path	csiph.com!weretis.net!feeder6.news.weretis.net!i2pn.org!rocksolid2!def5!.POSTED.bogusentry!not-for-mail
From	Anonymous <poster@anon.com>
Newsgroups	rocksolid.shared.security
Subject	long live return code 444
Date	Sun, 26 Jul 2020 15:58:22 -0700
Organization	def5
Message-ID	<opsec.703.16vmh7@anon.com> (permalink)
Content-Type	text/plain; charset=UTF-8
Injection-Info	def5.org; posting-host="bogusentry:192.168.1.189"; logging-data="25743"; mail-complaints-to="usenet@def5.org"
Xref	csiph.com rocksolid.shared.security:7

Show key headers only | View raw

https://nginx.org/en/docs/http/ngx_http_rewrite_module.html#return

Block certain kinds of ddos at application level simply by dropping the connection with your reverse http proxy. works like a charm, simpler and more effective than lowlevel blocking attempts (like with iptables).

You can base the criteria which connection to drop on all kind of shit like user-agent, url, request method or any other var you can access. Also you can use combinations of them to fingerprint annoying bots.

And nginxs non standard return code 444 simply drops the connection without giving any answer, thus not wasting any more server resoources like cpu time or open sockets or giving more information to potential attackers. 

Fucking awesome ! nginx just rocks.

-- 
Posted on def2

Back to rocksolid.shared.security | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

long live return code 444 Anonymous <poster@anon.com> - 2020-07-26 15:58 -0700
  Re: long live return code 444 retro.guy@rocksolidbbs.com (Retro Guy) - 2020-07-27 08:20 +0000
  Zones Anonymous <poster@anon.com> - 2020-07-27 11:25 -0700
    Re: Zones retro.guy@rocksolidbbs.com (Retro Guy) - 2020-08-05 04:51 +0000
  nginx is great Anonymous <poster@anon.com> - 2020-08-01 15:13 -0700
    Re: nginx is great AnonUser@rslight.i2p (AnonUser) - 2020-08-05 01:13 +0000
  Re: long live return code 444 anon <anon@anon.com> - 2020-08-05 19:01 +0000

csiph-web