3

I have an Ubuntu, Apache, Passenger, and Rails 4 project on AWS EC2.

I am unfamiliar with the security and server side of my project. Recently, my site was down because of "too many users" so when I checked my 

tail -f log/production.log

I saw that I was getting non-stop GET requests from random IPs to my home page. The requests have not stopped and continue to flood my server.

Is my server being used as a proxy or is it being attacked? How can I prevent this from continuing to happen?

I attempted to use this guide but as you will see from my other SO post, I was unsuccessful and was only able to stop ALL requests including valid ones. https://wiki.apache.org/httpd/ProxyAbuse https://stackoverflow.com/questions/29401312/log-shows-constant-get-requests-from-unknown-ips

Log - this grouping repeats with a new IP nonstop

I, [2015-04-02T16:38:47.692152 #11851]  INFO -- :   Rendered layouts/_google_analytics.html.erb (0.1ms)
I, [2015-04-02T16:38:47.692709 #11851]  INFO -- : Completed 200 OK in 9ms (Views: 8.6ms | ActiveRecord: 0.0ms)
I, [2015-04-02T16:38:49.073504 #11851]  INFO -- : Started GET "/" for 54.252.254.204 at 2015-04-02 16:38:49 +0000
I, [2015-04-02T16:38:49.077260 #11851]  INFO -- : Processing by HomeController#home_page as */*
I, [2015-04-02T16:38:49.084489 #11851]  INFO -- :   Rendered home/_sign_up_modal.html.erb (1.6ms)
I, [2015-04-02T16:38:49.084799 #11851]  INFO -- :   Rendered home/home_page.html.erb within layouts/application (6.2ms)
I, [2015-04-02T16:38:49.085349 #11851]  INFO -- :   Rendered /home/ubuntu/.rvm/gems/ruby-2.1.5/gems/stripe-rails-0.3.1/app/views/stripe/_js.html.erb (0.1ms)
I, [2015-04-02T16:38:49.086550 #11851]  INFO -- :   Rendered layouts/_google_analytics.html.erb (0.0ms)
I, [2015-04-02T16:38:49.087121 #11851]  INFO -- : Completed 200 OK in 10ms (Views: 8.8ms | ActiveRecord: 0.0ms)
I, [2015-04-02T16:38:50.166665 #11851]  INFO -- : Started GET "/" for 107.23.255.12 at 2015-04-02 16:38:50 +0000
I, [2015-04-02T16:38:50.169943 #11851]  INFO -- : Processing by HomeController#home_page as */*
I, [2015-04-02T16:38:50.176601 #11851]  INFO -- :   Rendered home/_sign_up_modal.html.erb (1.4ms)
I, [2015-04-02T16:38:50.176924 #11851]  INFO -- :   Rendered home/home_page.html.erb within layouts/application (5.5ms)
I, [2015-04-02T16:38:50.177425 #11851]  INFO -- :   Rendered /home/ubuntu/.rvm/gems/ruby-2.1.5/gems/stripe-rails-0.3.1/app/views/stripe/_js.html.erb (0.1ms)

And another set from a different time period:

I, [2015-04-03T19:37:02.737535 #8097]  INFO -- :   Rendered layouts/_google_analytics.html.erb (0.1ms)
I, [2015-04-03T19:37:02.738015 #8097]  INFO -- : Completed 200 OK in 8ms (Views: 7.1ms | ActiveRecord: 0.0ms)
I, [2015-04-03T19:37:06.459500 #8097]  INFO -- : Started GET "/" for 54.255.254.236 at 2015-04-03 19:37:06 +0000
I, [2015-04-03T19:37:06.462434 #8097]  INFO -- : Processing by HomeController#home_page as */*
I, [2015-04-03T19:37:06.468158 #8097]  INFO -- :   Rendered home/_sign_up_modal.html.erb (1.2ms)
I, [2015-04-03T19:37:06.468466 #8097]  INFO -- :   Rendered home/home_page.html.erb within layouts/application (4.8ms)
I, [2015-04-03T19:37:06.469006 #8097]  INFO -- :   Rendered /home/ubuntu/.rvm/gems/ruby-2.1.5/gems/stripe-rails-0.3.1/app/views/stripe/_js.html.erb (0.1ms)
I, [2015-04-03T19:37:06.470022 #8097]  INFO -- :   Rendered layouts/_google_analytics.html.erb (0.1ms)
I, [2015-04-03T19:37:06.470502 #8097]  INFO -- : Completed 200 OK in 8ms (Views: 7.2ms | ActiveRecord: 0.0ms)
I, [2015-04-03T19:37:07.079266 #8097]  INFO -- : Started GET "/" for 54.183.255.140 at 2015-04-03 19:37:07 +0000
I, [2015-04-03T19:37:07.081831 #8097]  INFO -- : Processing by HomeController#home_page as */*
I, [2015-04-03T19:37:07.087211 #8097]  INFO -- :   Rendered home/_sign_up_modal.html.erb (1.2ms)
I, [2015-04-03T19:37:07.087518 #8097]  INFO -- :   Rendered home/home_page.html.erb within layouts/application (4.6ms)
I, [2015-04-03T19:37:07.088029 #8097]  INFO -- :   Rendered /home/ubuntu/.rvm/gems/ruby-2.1.5/gems/stripe-rails-0.3.1/app/views/stripe/_js.html.erb (0.1ms)
I, [2015-04-03T19:37:07.089000 #8097]  INFO -- :   Rendered layouts/_google_analytics.html.erb (0.1ms)
I, [2015-04-03T19:37:07.089471 #8097]  INFO -- : Completed 200 OK in 7ms (Views: 6.8ms | ActiveRecord: 0.0ms)
I, [2015-04-03T19:37:09.102373 #8097]  INFO -- : Started GET "/" for 107.23.255.12 at 2015-04-03 19:37:09 +0000
I, [2015-04-03T19:37:09.105359 #8097]  INFO -- : Processing by HomeController#home_page as */*
I, [2015-04-03T19:37:09.111001 #8097]  INFO -- :   Rendered home/_sign_up_modal.html.erb (1.2ms)
I, [2015-04-03T19:37:09.111348 #8097]  INFO -- :   Rendered home/home_page.html.erb within layouts/application (4.8ms)
I, [2015-04-03T19:37:09.111855 #8097]  INFO -- :   Rendered /home/ubuntu/.rvm/gems/ruby-2.1.5/gems/stripe-rails-0.3.1/app/views/stripe/_js.html.erb (0.1ms)

The only difference with each request is that the GET is from a different 54.###.##.### IP that changes each time. None of them are users, I am sure of that.

Started GET "/" for 54.###.##.### at 2015-04-01 21:37:44 +0000

And my .conf

/etc/apache2/sites-available/000-default.conf

<VirtualHost *:80>
  ServerName ec2-54-###-###-##.us-west-2.compute.amazonaws.com
  # !!! Be sure to point DocumentRoot to 'public'!
  DocumentRoot /etc/projects/myapp/public

    <Directory /etc/projects/myapp/public>
            #Options FollowSymLinks
            Options Indexes FollowSymLinks Includes ExecCGI
            AllowOverride All
            Order deny,allow
            Allow from all
    </Directory>

I can provide more information if needed.

What can I do to solve this issue?

| improve this question | |
  • An excerpt of the logs might be helpful – wireghoul Apr 2 '15 at 12:22
  • @wireghoul thank you for your guidance. I have added the logs and my .conf file – MicFin Apr 2 '15 at 12:25
  • Based on the log excerpt you're not being used as a proxy, it is likely something else causing it. The requests are about 3 per second peak, which should not be the cause. Assuming your too many users errors were from the web server you could check the error log for more information – wireghoul Apr 2 '15 at 12:34
  • Can you provide the first three octets of several of the source IP addresses? – Bob Brown Apr 2 '15 at 22:51
  • 2
    @cybermike IP spoofing only works when you don't need a reply (common with UDP-based attacks). For an HTTP request to succeed you do need a reply (to establish the connection), so IP spoofing is impossible (other than in extreme cases where the attacker controls a router between your server and the internet, but even if that's the case I doubt they'd use it for DoS). – user42178 Apr 3 '15 at 15:24
2

This could either be a DDOS, albeit a low scale one, or Cash-overflow attack (given that you're on AWS) https://www.owasp.org/index.php/Cash_Overflow

Edit: Also worth noting, that if someone is attempting to use your server as a proxy, you would see something like this in your Apache logs:

X.X.X.X - [20/Apr/2015:12:39:11 +0100] "GET http://somewherethatisnotyou.com HTTP/1.1" 404 395 "-" "Mozilla/5.0 (Windows NT 5.1; rv:32.0) Gecko/20100101 Firefox/31.0"

Where X.X.X.X is attempting to GET another site through yours.

Further reading, and how to disable accessing any host not configured: https://wiki.apache.org/httpd/ProxyAbuse

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.