this post was submitted on 10 Nov 2023
3 points (100.0% liked)

Self-Hosted Main

21 readers
1 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

For Example

We welcome posts that include suggestions for good self-hosted alternatives to popular online services, how they are better, or how they give back control of your data. Also include hints and tips for less technical readers.

Useful Lists

founded 1 year ago
MODERATORS
communick@selfhosted.forum
3
Intrusion? Nginx (alien.top)
submitted 1 year ago by 9acca9@alien.top to c/main@selfhosted.forum
4 comments fedilink hide all child comments
 

So, im a newbie here.

I have some services running.

I put today all behind Nginx as a reverse proxy. And im using ssl/tls from letsencrypt.

I found this ip in my access.log from Nginx.

83.97.73.87 - - [10/Nov/2023:12:20:35 -0300] "GET /_ignition/execute-solution HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
83.97.73.87 - - [10/Nov/2023:12:23:23 -0300] "GET / HTTP/1.1" 200 615 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
83.97.73.87 - - [10/Nov/2023:12:45:26 -0300] "GET / HTTP/1.1" 200 615 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"

I look for that ip and it seems that is a BAD IP!!!

Look https://www.abuseipdb.com/check/83.97.73.87

Im fine or i need to do something to avoid this?!

Im safe or this could made something to my server?

you are viewing a single comment's thread
view the rest of the comments
[–] bl_r 1 points 1 year ago

This looks like a port scanning address, which is normal. Being scanned is just a fact of life if you host a service on the internet. What exactly was in your access log? Is it a connection on / ? Is it a 404 on a weird path? Is it accessing data on a service you run?

Personally, I’d block the IP and move on, since 99 times in 100, its not too big of a deal since an automated scan won’t do much. If it is scanning services you actively run, it would warrant digging in deeper, reading all logs and bit more closely, but it is still not too likely it will result in an intrusion.