tl;dr: https://code.petermolnar.net/ngx-http-blocklistd
I wrote about having fun with bots and scapers before that I brought
upon myself by having nepenthes added to my server1. As things currently stand, unless
you want to or can afford A LOT OF traffic, you shouldn't do what I
did.
Anyhow, now that all the links are removed from everywhere it means that there's a certain path prefix that I know 100% sure it's nasty bot traffic and I'd be happy to block the IP immediately if it ends up there.
The last time I tried fail2ban, my CPU got overloaded. I then tried blocking at ASN level2, but I regularly ended up blocking M$, Google Cloud, and other things, eventually blocking some of the indieweb tooling3 from accessing my site with that blast radius.
I have turned to blocklistd4
(formerly called blacklistd) for blocking SSH and Postfix
attempts, because it has it built in. It's a (Net)BSD security tool that
listens on a socket for messages with IPs to be blocked by your
firewall. In a sense it does the same job as fail2ban, but with much
less overhead: it doesn't need logs to be writter, logs to be read and
parsed, and it's written in C.
The nginx module that communicates to blocklistd didn't exist, so I decided to write it. The end results looks way simpler, than finding the resources were, but these were quite helpful:
- Emiller’s Guide To Nginx Module Development https://www.evanmiller.org/nginx-modules-guide.html
- Learning a new codebase: hacking on nginx https://notes.eatonphil.com/learning-a-new-codebase-hacking-nginx.html
- nginx Development guide https://nginx.org/en/docs/dev/development_guide.html
- A Guide to: NGINX Error Logs https://trunc.org/learning/everything-you-dont-need-to-know-about-nginx-error-logs
- nginx-dev-examples https://github.com/nginx/nginx-dev-examples/tree/main/hello_world_1
- ssh diff in blacklistd source https://github.com/paul-chambers/blacklistd/blob/trunk/diff/ssh.diff
It is now working and I'm testing how far I can take it. For what it's worth, I'm not going back to the endless AI poison maze experiment, because I can't afford to jeopardise that level of traffic on my home connection, but I will most likely put honeypot links back soon.
This entry was written by Peter Molnar, and originally posted on petermolnar dot net.
