isipsafe
nginx logo

nginx

Report scanners and exploit attempts from access logs, and block listed addresses at the web server.

Scanners give themselves away by asking for files that do not exist on your site: .env, .git/config, wp-login.php on a site that has never run WordPress. These recipes report them, and the last section blocks listed addresses at nginx itself.

Report scanners

Reports anyone who probed for common secrets and admin panels in today's log. Remove any path your site really uses, for example wp-login\.php on a WordPress site.

grep -E '"(GET|POST|HEAD) /+(\.env|\.git/|wp-login\.php|xmlrpc\.php|wp-config|phpmyadmin|pma/|vendor/phpunit|cgi-bin/|boaform|actuator/)' /var/log/nginx/access.log | awk '{print $1}' | sort -u | xargs -r -I{} curl -s "https://isipsafe.com/api/v1/report?key=$ISIPSAFE_KEY" -d ip={} -d categories=web-app-attack,vuln-scan -d comment="probing for .env/.git/wp-login/phpmyadmin"

Report injection attempts

grep -iE 'union(%20|\+| )select|information_schema|sleep\(|\$\{jndi:|/etc/passwd|;wget ' /var/log/nginx/access.log | awk '{print $1}' | sort -u | xargs -r -I{} curl -s "https://isipsafe.com/api/v1/report?key=$ISIPSAFE_KEY" -d ip={} -d categories=sql-injection,rce,web-app-attack -d comment="injection payload in request"

Behind Cloudflare or a load balancer, the first field of the log is the proxy, not the visitor. Configure real_ip_header and set_real_ip_from (nginx's realip module) first, or you will report your own proxy.

Or use fail2ban

fail2ban ships an nginx-botsearch jail that does the same detection continuously. Add the isipsafe action with categories="web-app-attack,vuln-scan".

Block listed addresses in nginx

  1. Fetch the list as nginx rules, test the config and reload. Put this in an hourly cron job: 
    curl -sf "https://isipsafe.com/api/v1/blocklist?key=$ISIPSAFE_KEY&format=nginx" -o /etc/nginx/isipsafe.conf.new && mv /etc/nginx/isipsafe.conf.new /etc/nginx/isipsafe.conf && nginx -t && nginx -s reload
  2. Include it in the server blocks you want to protect: 
    server {
    include /etc/nginx/isipsafe.conf;
    ...
}

Blocking in the firewall is cheaper than in nginx. See Linux firewall if you have root on the box.

Need a hand?

If something here does not work with your version of nginx, or you have improved it, tell us. We update these pages with what people send.

nginx and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.