Intrusion? Nginx reddit / selfhosted ---------------------------------------------------------------------- 9acca9 · 2023-11-10 16:27 So, im a newbie here. I have some services running. I put today all behind Nginx as a reverse proxy. And im using ssl/tls from letsencrypt. I found this ip in my access.log from Nginx. 83.97.73.87 - - [10/Nov/2023:12:20:35 -0300] "GET /_ignition/execute-solution HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" 83.97.73.87 - - [10/Nov/2023:12:23:23 -0300] "GET / HTTP/1.1" 200 615 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" 83.97.73.87 - - [10/Nov/2023:12:45:26 -0300] "GET / HTTP/1.1" 200 615 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" I look for that ip and it seems that is a BAD IP!!! Look [https://www.abuseipdb.com/check/83.97.73.87](https://www.abuseip db.com/check/83.97.73.87) Im fine or i need to do something to avoid this?! Im safe or this could made something to my server? ---------------------------------------------------------------------- cshaiku · 2023-11-10 17:32 Naw, you're fine. It's just [russian bots](https://whatismyipaddress.com/ip/83.97.73.87) trying to scrape your site, looking for vulnerabilities. This may prove helpful: https://stackoverflow.com/questions/58249085/how-to-solve-facade- ignition-http-middleware-ignitionenabled ---------------------------------------------------------------------- cdemi · 2023-11-10 17:33 Welcome to the Internet. Check out Crowdsec and WAFs ---------------------------------------------------------------------- OxFEEDBEEF · 2023-11-10 17:36 > /_ignition/execute-solution It's a bot trying to scan for an exploit for Laravel (a PHP framework). You'll see thousands of those types of scans drive by every day. Welcome to the Internet. Last time I deployed a new server online it took about 2 minutes for the first one to come knocking. You can use something like [Crowdsec](https://www.crowdsec.net/) to block this, or some other solution if you want to keep your services on the internet via a proxy. Alternatively, if you're the only user, don't host them on the Internet directly, but hide them behind a VPN. ---------------------------------------------------------------------- MacaroniOnly · 2023-11-10 17:36 The unfortunate truth of the internet is that once you reveal a service to it, bots and crawlers will be over that service immediately. As long as you have a firewall, your server is up-to- date, and your services are behind some sort of login page or allow list, you'll be fine ---------------------------------------------------------------------- 9acca9 · 2023-11-10 18:03 >Alternatively, if you're the only user, don't host them on the Internet directly, but hide them behind a VPN. yes, is just me (and my girlfriend). I need to pay for this? what i need to install? i always though that vpn a service that you have to pay. Maybe it is not? Thanks. ---------------------------------------------------------------------- 9acca9 · 2023-11-10 18:06 >your services are behind some sort of login page or allow list, you'll be fine yep, all my services need a password. But i have the default web of Nginx on 443, i mean if you go to [www.mydomain.com](https://www.mydomain.com) you will see: Welcome to nginx! If you see this page, the nginx web server is successfully installed and working. Further configuration is required. This is relevant? maybe better dont have any page there? my services are in urls like this: [www.mydomain.com/trilium](https://www.mydomain.com/trilium) ---------------------------------------------------------------------- sarkyscouser · 2023-11-10 18:42 Tailscale ---------------------------------------------------------------------- hannsr · 2023-11-10 18:49 Nah, it's fine. It's just the default static page. If you don't want it, make it a redirect and send the bots to Google or whatever. But ultimately it doesn't matter really. ---------------------------------------------------------------------- WiseCookie69 · 2023-11-10 18:49 Normal background noise. You expose stuff to the public and in return you make friends with a bunch of bots. ---------------------------------------------------------------------- OxFEEDBEEF · 2023-11-10 18:57 > I need to pay for this? Not necessarily. > what i need to install? The easiest option for you is probably [Tailscale](https://tailscale.com/). There's one part in TailScale that isn't self-hosted, the control plane, but the rest of it is open source. Read up on the documentation of Tailscale how it works, and see if it's a good fit for you. But there's also completely self-hosted options there too. I've run a bunch of different things like * [WireGuard](https://www.wireguard.com/) * [OpenVPN](https://openvpn.net/community/) * IPSec VPN which are more traditional VPN solutions. Tailscale will probably be easiest for you to install and manage, and as your needs evolve you might want a different solution. ---------------------------------------------------------------------- 9acca9 · 2023-11-10 19:06 lol, thanks.