Tag Info

New answers tagged

3

First, you have no way to avoid people using curl to access the API. On the server perspective, your application and someone using curl or telnetting in is exactly the same. You must employ some controls and protections on the API that will make harder to people just fire up curl and mess with you database. As you are learning, I will not give you links, ...


0

Adding these two lines to my httpd.conf seems to have resolved the issue: AcceptFilter https none AcceptFilter http none The issue ended up not being specific to openssl but it did require the client to hold the connection open. I could create the same situtation using telnet. c:\telnet myserver 80 Would block connections for other users as well


0

As mentioned, you can block entire country and you can also block IPs from servers: From the Amazon Datacenter as example. I am using the list of IPs provided by : http://www.wizcrafts.net/ You can use a fail2ban filter like this one : [Definition] failregex = ^ .* POST /register.* ^ .* PUT /register.* and the corresponding configuration ...


9

How can I defend against malicious GET requests? These requests do not look really malicious. At least based on your description they don't cause any harm, i.e. no unwanted code execution, SQL injection or similar attacks. They only need some resources to process. What you see is what every operator of a web server can see in the log files: lots of ...


5

In conjunction with what @SakamakiIzayoi suggested: Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc. Generally Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time, although any ...


4

The easiest defense solution would be to install a Web Application Firewall. You can find in-depth descriptions regarding them on OWASP and Wikipedia. I doubt the requests would slow down your site. Attackers would most likely request existing items as it would be far more effective in wasting your web-server's resources.


2

When I do openssl s_client -connect myservername:443 -starttls smtp, other clients are still supported just fine. Of course, the connection from OpenSSL fails: $ openssl s_client -connect myservername:443 -starttls smtp CONNECTED(00000003) didn't found starttls in server response, try anyway... 140029862278800:error:140790E5:SSL routines:SSL23_WRITE:ssl ...


2

regarding question 1: You can setup most webservers as a reverse proxy(IIS, Apache, Nginx and even NodeJS all work). IIS and Nginx are preferable(but not necessary) as they are faster(just my opinion - this may not always be true). Instructions for setting up IIS as a proxy can be found here Instructions for setting up Nginx as reverse proxy there are ...


0

Sort of. You can create a landing page that lists all client IP addresses using WebRTC and load another address. You can use gethostbyaddr() on every IP returned, and you will get some user198.domain-a.company.xxx. Just set a session variable, and you are set.


0

Not really. You can directly retrieve some agent information and the local IP/hostname but not their workgroup/domain status. That being said - you could get the hostname and query Active Directory via WMI to see if it is a domain computer, but you can never prove the validity of the hostname. Another option is that you can authenticate a user against ...


-1

It's possible to get corresponding to a given IP address using gethostbyaddr function http://php.net/manual/en/function.gethostbyaddr.php: $proxy = (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : false; if(!!$proxy){ $ipaddress = $_SERVER['HTTP_X_FORWARDED_FOR']; echo "Warning: Your cliend is using proxy, may could ...


0

Server certificates can have multiple chain of trusts (the certificate have multiple roots), and the browser only need to trust one chain to trust the server's certificate. I don't know whether browser actually supports this for client certificates as well. But if they do, you would be able to ship the client certificate signed with two separate root ...


3

Instead of setting up multiple CAs, you can just tweak access settings in your Apache configuration. Look at Require directive: http://httpd.apache.org/docs/2.2/mod/core.html#require If you set any authentication requirement, then default Require level is implicitly set to "valid-user" (anyone that meets other requirements). But using Require, optionally ...



Top 50 recent answers are included