3

I have an Ubuntu, Apache, Passenger, and Rails 4 project on AWS EC2.

I am unfamiliar with the security and server side of my project. Recently, my site was down because of "too many users" so when I checked my

tail -f log/production.log

I saw that I was getting non-stop GET requests from random IPs to my home page. The requests have not stopped and continue to flood my server.

Is my server being used as a proxy or is it being attacked? How can I prevent this from continuing to happen?

I attempted to use this guide but as you will see from my other SO post, I was unsuccessful and was only able to stop ALL requests including valid ones. https://wiki.apache.org/httpd/ProxyAbuse https://stackoverflow.com/questions/29401312/log-shows-constant-get-requests-from-unknown-ips

Log - this grouping repeats with a new IP nonstop

I, [2015-04-02T16:38:47.692152 #11851]  INFO -- :   Rendered layouts/_google_analytics.html.erb (0.1ms)
I, [2015-04-02T16:38:47.692709 #11851]  INFO -- : Completed 200 OK in 9ms (Views: 8.6ms | ActiveRecord: 0.0ms)
I, [2015-04-02T16:38:49.073504 #11851]  INFO -- : Started GET "/" for 54.252.254.204 at 2015-04-02 16:38:49 +0000
I, [2015-04-02T16:38:49.077260 #11851]  INFO -- : Processing by HomeController#home_page as */*
I, [2015-04-02T16:38:49.084489 #11851]  INFO -- :   Rendered home/_sign_up_modal.html.erb (1.6ms)
I, [2015-04-02T16:38:49.084799 #11851]  INFO -- :   Rendered home/home_page.html.erb within layouts/application (6.2ms)
I, [2015-04-02T16:38:49.085349 #11851]  INFO -- :   Rendered /home/ubuntu/.rvm/gems/ruby-2.1.5/gems/stripe-rails-0.3.1/app/views/stripe/_js.html.erb (0.1ms)
I, [2015-04-02T16:38:49.086550 #11851]  INFO -- :   Rendered layouts/_google_analytics.html.erb (0.0ms)
I, [2015-04-02T16:38:49.087121 #11851]  INFO -- : Completed 200 OK in 10ms (Views: 8.8ms | ActiveRecord: 0.0ms)
I, [2015-04-02T16:38:50.166665 #11851]  INFO -- : Started GET "/" for 107.23.255.12 at 2015-04-02 16:38:50 +0000
I, [2015-04-02T16:38:50.169943 #11851]  INFO -- : Processing by HomeController#home_page as */*
I, [2015-04-02T16:38:50.176601 #11851]  INFO -- :   Rendered home/_sign_up_modal.html.erb (1.4ms)
I, [2015-04-02T16:38:50.176924 #11851]  INFO -- :   Rendered home/home_page.html.erb within layouts/application (5.5ms)
I, [2015-04-02T16:38:50.177425 #11851]  INFO -- :   Rendered /home/ubuntu/.rvm/gems/ruby-2.1.5/gems/stripe-rails-0.3.1/app/views/stripe/_js.html.erb (0.1ms)

And another set from a different time period:

I, [2015-04-03T19:37:02.737535 #8097]  INFO -- :   Rendered layouts/_google_analytics.html.erb (0.1ms)
I, [2015-04-03T19:37:02.738015 #8097]  INFO -- : Completed 200 OK in 8ms (Views: 7.1ms | ActiveRecord: 0.0ms)
I, [2015-04-03T19:37:06.459500 #8097]  INFO -- : Started GET "/" for 54.255.254.236 at 2015-04-03 19:37:06 +0000
I, [2015-04-03T19:37:06.462434 #8097]  INFO -- : Processing by HomeController#home_page as */*
I, [2015-04-03T19:37:06.468158 #8097]  INFO -- :   Rendered home/_sign_up_modal.html.erb (1.2ms)
I, [2015-04-03T19:37:06.468466 #8097]  INFO -- :   Rendered home/home_page.html.erb within layouts/application (4.8ms)
I, [2015-04-03T19:37:06.469006 #8097]  INFO -- :   Rendered /home/ubuntu/.rvm/gems/ruby-2.1.5/gems/stripe-rails-0.3.1/app/views/stripe/_js.html.erb (0.1ms)
I, [2015-04-03T19:37:06.470022 #8097]  INFO -- :   Rendered layouts/_google_analytics.html.erb (0.1ms)
I, [2015-04-03T19:37:06.470502 #8097]  INFO -- : Completed 200 OK in 8ms (Views: 7.2ms | ActiveRecord: 0.0ms)
I, [2015-04-03T19:37:07.079266 #8097]  INFO -- : Started GET "/" for 54.183.255.140 at 2015-04-03 19:37:07 +0000
I, [2015-04-03T19:37:07.081831 #8097]  INFO -- : Processing by HomeController#home_page as */*
I, [2015-04-03T19:37:07.087211 #8097]  INFO -- :   Rendered home/_sign_up_modal.html.erb (1.2ms)
I, [2015-04-03T19:37:07.087518 #8097]  INFO -- :   Rendered home/home_page.html.erb within layouts/application (4.6ms)
I, [2015-04-03T19:37:07.088029 #8097]  INFO -- :   Rendered /home/ubuntu/.rvm/gems/ruby-2.1.5/gems/stripe-rails-0.3.1/app/views/stripe/_js.html.erb (0.1ms)
I, [2015-04-03T19:37:07.089000 #8097]  INFO -- :   Rendered layouts/_google_analytics.html.erb (0.1ms)
I, [2015-04-03T19:37:07.089471 #8097]  INFO -- : Completed 200 OK in 7ms (Views: 6.8ms | ActiveRecord: 0.0ms)
I, [2015-04-03T19:37:09.102373 #8097]  INFO -- : Started GET "/" for 107.23.255.12 at 2015-04-03 19:37:09 +0000
I, [2015-04-03T19:37:09.105359 #8097]  INFO -- : Processing by HomeController#home_page as */*
I, [2015-04-03T19:37:09.111001 #8097]  INFO -- :   Rendered home/_sign_up_modal.html.erb (1.2ms)
I, [2015-04-03T19:37:09.111348 #8097]  INFO -- :   Rendered home/home_page.html.erb within layouts/application (4.8ms)
I, [2015-04-03T19:37:09.111855 #8097]  INFO -- :   Rendered /home/ubuntu/.rvm/gems/ruby-2.1.5/gems/stripe-rails-0.3.1/app/views/stripe/_js.html.erb (0.1ms)

The only difference with each request is that the GET is from a different 54.###.##.### IP that changes each time. None of them are users, I am sure of that.

Started GET "/" for 54.###.##.### at 2015-04-01 21:37:44 +0000

And my .conf

/etc/apache2/sites-available/000-default.conf

<VirtualHost *:80>
  ServerName ec2-54-###-###-##.us-west-2.compute.amazonaws.com
  # !!! Be sure to point DocumentRoot to 'public'!
  DocumentRoot /etc/projects/myapp/public

    <Directory /etc/projects/myapp/public>
            #Options FollowSymLinks
            Options Indexes FollowSymLinks Includes ExecCGI
            AllowOverride All
            Order deny,allow
            Allow from all
    </Directory>

I can provide more information if needed.

What can I do to solve this issue?

10
  • An excerpt of the logs might be helpful
    – wireghoul
    Apr 2, 2015 at 12:22
  • @wireghoul thank you for your guidance. I have added the logs and my .conf file
    – MicFin
    Apr 2, 2015 at 12:25
  • Based on the log excerpt you're not being used as a proxy, it is likely something else causing it. The requests are about 3 per second peak, which should not be the cause. Assuming your too many users errors were from the web server you could check the error log for more information
    – wireghoul
    Apr 2, 2015 at 12:34
  • Can you provide the first three octets of several of the source IP addresses?
    – Bob Brown
    Apr 2, 2015 at 22:51
  • 2
    @cybermike IP spoofing only works when you don't need a reply (common with UDP-based attacks). For an HTTP request to succeed you do need a reply (to establish the connection), so IP spoofing is impossible (other than in extreme cases where the attacker controls a router between your server and the internet, but even if that's the case I doubt they'd use it for DoS).
    – user42178
    Apr 3, 2015 at 15:24

1 Answer 1

2

This could either be a DDOS, albeit a low scale one, or Cash-overflow attack (given that you're on AWS) https://www.owasp.org/index.php/Cash_Overflow

Edit: Also worth noting, that if someone is attempting to use your server as a proxy, you would see something like this in your Apache logs:

X.X.X.X - [20/Apr/2015:12:39:11 +0100] "GET http://somewherethatisnotyou.com HTTP/1.1" 404 395 "-" "Mozilla/5.0 (Windows NT 5.1; rv:32.0) Gecko/20100101 Firefox/31.0"

Where X.X.X.X is attempting to GET another site through yours.

Further reading, and how to disable accessing any host not configured: https://wiki.apache.org/httpd/ProxyAbuse

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .