I didn’t run a command, I checked my nginx error logs and noticed the below error being recorded (fairly regularly).
Further to this, my site’s nginx config (relating to SSL) is as follows:
server {
#other config relating to the site here
#location {} and all that fun stuff
listen 443 ssl http2; # managed by Certbot
#listen [::]:443 ssl http2 ipv6only=off;
ssl_certificate /etc/letsencrypt/live/willstocks.co.uk/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/willstocks.co.uk/privkey.pem; # managed by Certbot
#include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_ciphers TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-256-GCM-SHA384:TLS13-AES-128-GCM-SHA256:EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
I have a feeling it relates to the ssl_ciphers, but I’m not 100% familiar with what should be here… As a matter of fact, I’m not 100% sure where this line came from
Sorry - forgot to disable Cloudflare while I ran that test! I’ll disable and will run again
Yes, I use Cloudflare, however I’m seeing the error on my actual server itself - when hit directly (i.e. when I’m making changes to the site, I disable Cloudflare so I don’t get any weird caching/weirdness!
You hid the source IP.
Is it always the same one (with the problem)?
Do you recognize the source IP?
If so, does that side show anything else in the logs or screen(shot)?
I can confirm that the errors were from a period of time where I was not doing any testing at all - I will, however, try to confirm whether it was a bot or not (the error log did not provide UA info)
@rg305 - I did strip it out, but can provide if necessary? If I look back through older log files (not just today) there are more of the errors, and all have different IP’s so I’m inclined to think it’s not a single user?
I assume it’s possibly either a bot or a service, as it must be bypassing Cloudflare to hit my server directly for SSL termination?
If it is bypassing CloudFlare, then it must be hitting your IP directly.
Which means they are NOT using the FQDN.
This sounds very much like a bot [scanning or actively hacking].
If you know the CloudFlare IPs that are used, you can "whitelist" them and block all others.
It seems very possible that this problem is a problem with a client (whether a bot or a browser). I’m tempted to say that unless you know that any legitimate users are encountering it, you can ignore it—especially if mainstream testing tools (and mainstream browsers) seem to regard your site as working properly.
It could be that a bot or a browser is implementing one of the supported ciphersuites incorrectly for some reason.
I don't know for sure whether Cloudflare publishes this information either, but if they do, then this should also work well: your origin server would effectively be hidden from Internet-wide scans.
Is there true benefit in doing this, other than ensuring traffic is all going via Cloudflare? Also, are you able to provide any resource for accomplishing such a task, as it's not actually one I'm familiar with!
I haven't setup anything to use IP, so it must just be some form of scraping/scanning?
Not really. If you rely on particular Cloudflare (security) features, you might want to make it impossible for them to be bypassed -- but IP address blocking doesn't entirely accomplish that, and regardless anyone who knows your IP can always DDoS it.
Right.
You should probably make sure that the web server doesn't have other virtual hosts -- or the default virtual host -- serving the same site.
Well, they might happen to access it during that minute.
Especially if you didn't always use Cloudflare, some services will have archived the association between that IP and that domain, and might continue to obnoxiously scan it for whatever reason.
And there are only 4 billion IPv4 addresses; they all get HTTP requests, whether or not they're known to be associated with particular domains.
Not sure which response to pick as the resolving response now!
Thanks for all your help/responses guys - I’m thinking about just ignoring, and if it sticks in my head for an extended period of time then I’ll think about ensuring all traffic comes in via CF
In the past, scans with tools like nmap commonly took a couple of days or so to contact every IPv4 address, while zmap is able to do this in a few minutes.
ZMap is a fast single packet network scanner designed for Internet-wide network surveys. On a computer with a gigabit connection, ZMap can scan the entire public IPv4 address space in under 45 minutes. With a 10gigE connection and PF_RING, ZMap can scan the IPv4 address space in 5 minutes.
My updated joke about this: "An American thinks 100 years is a long time, an Englishman thinks 100 miles is a long distance, a human thinks 2³³ individuals is a large population."
