I was stumped when I saw the following lines on my Apache server error log this morning:
[authz_core:error] [client ::1:37317] AH01630: client denied by server configuration: /var/www/styles/style.css, referer: http://bd.adm.ijinshan.com/adm.html?adm=somehexdec&t=timestamp [authz_core:error] [client ::1:37317] AH01630: client denied by server configuration: /var/www/scripts/script.js, referer: http://bd.adm.ijinshan.com/adm.html?adm=somehexdec&t=timestamp
I might have accessed some forum which triggers the site to contact my web server. But my server has a firewall that is configured explicitly to allow access only from a few internal ip addresses. I suspect it could be the following line in my
iptables config that allows them to access my server:
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
Is it true that if I inadvertently contacted the server by accessing a hidden iframe in some forum that I am allowing the website to access my server? How did it guess the location of my script and stylesheet given that there could be thousands of path combinations? And what is the intention of trying to hotlink to them? Could this be malicious? The website seems like some antivirus company in China.
Going into the server access log, I found the following line:
127.0.0.1 GET /adm.html?adm=somehexdec&t=timestamp HTTP/1.1 404 http://snippet.pos.baidu.com/bfp/snippetcacher.php?qn=somehexdec
Ok, now I understand that my server issued a 404 custom error page (obviously because there is no
adm.html) which contains the script and css file. That part of the mystery is solved. And also, my firewall rules seems to work correctly since the ip address 127.0.0.1 represents localhost.
Now the problem is identifying why accessing that page on baidu triggers a lookup on my localhost and whether this is a security issue.