环境卫生已由良好向严重过渡。81.8%的请求与HTTP 4xx有错误

Question

我在这里读了一些文章，并遵循了WAF的解决方案，所以我创建了分配给CloudFront的ACL，然后我创建了规则，它阻止所有在HTTP方法中包含word HEAD的请求。当我试图从postman发送HEAD请求时，它就像我想要的那样工作（我收到错误403)，但不幸的是，错误仍然存在，我每天都在apache日志中看到大量HEAD请求。

请求清单：

[01/Aug/2017:07:42:09+0000]“Head/MySQL/DBADMIN/HTTP/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/aug/2017:07:42:12+0000]“Head/phpmyadmin3/http/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/Aug/2017:07:42:13+0000]“Head/2phpMyAdmin/HTTP/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/Aug/2017:07:42:13+0000]“Head/phppma/HTTP/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/Aug/2017:07:42:15+0000]“Head/DBADMIN/HTTP/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/Aug/2017:07:42:16+0000]“Head/DB/HTTP/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/Aug/2017:07:42:16+0000]“Head/MySQL/HTTP/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/aug/2017:07:42:17+0000]“head/db/phpmyadmin/http/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/Aug/2017:07:42:17+0000]“Head/SQLManager/HTTP/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/aug/2017:07:42:19+0000]“head/admin/phpmyadmin/http/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/aug/2017:07:42:20+0000]“head/admin/sysadmin/http/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/Aug/2017:07:42:20+0000]“Head/Admin/DB/HTTP/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/Aug/2017:07:42:23+0000]“Head/MySQL/PMA/HTTP/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/Aug/2017:07:42:24+0000]“Head/SQL/PHP-MyAdmin/HTTP/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/Aug/2017:07:42:24+0000]“Head/SQL/SQL/HTTP/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/Aug/2017:07:42:30+0000]“Head/SQLADMIN/HTTP/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/aug/2017:07:42:30+0000]“head/sql/phpmyadmin2/http/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/Aug/2017:07:42:31+0000]“Head/SQL/phpMyAdmin/HTTP/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/Aug/2017:07:42:49+0000]“Head/DB/DBADMIN/HTTP/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/aug/2017:07:42:49+0000]“Head/db/phpmyadmin3/http/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/aug/2017:07:42:51+0000]“Head/db/phpmyadmin-3/http/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/Aug/2017:07:42:54+0000]“Head/Administrator/PMA/HTTP/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/aug/2017:07:42:54+0000]“Head/phpmyadmin2/http/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/aug/2017:07:42:55+0000]“Head/phpmyadmin4/http/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/Aug/2017:07:42:56+0000]“Head/PMA2014/HTTP/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/Aug/2017:07:42:57+0000]“Head/PMA2016/HTTP/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/Aug/2017:07:42:57+0000]“Head/PMA2018/HTTP/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/Aug/2017:07:43:00+0000]“Head/PMA2016/HTTP/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/Aug/2017:07:43:01+0000]“Head/PMA2018/HTTP/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/Aug/2017:07:43:01+0000]“Head/phpmyAdmin2012/HTTP/1.1”404 260“-”Mozilla/5.0 Jorgee“

[01/Aug/2017:07:43:04+0000]“Head/phpMyAdmin2018/HTTP/1.1”404 260“-”Mozilla/5.0 Jorgee“

谢谢你的帮助。

Answer 1

我直接联系了AWS支持部门，这是他们提供给我的解决方案：

我查看了您发布的日志以防万一，我发现代理是Jorgee，这是一个常见的恶意软件代理。我偶然发现了关于这个代理的博客[1]，尽管它不是官方的，但得到了它的见解。

Elastic Beanstalk environment实例中名为“healthd”的守护进程通过监视特殊的日志文件来监视运行状况。如果代理在该文件中发现大量的4xx，环境将进入严重状态。

.ebextensions/healthd_ignore_4xx.config

   files:
   "/etc/nginx/sites-enabled/elasticbeanstalk-nginx-docker-proxy.conf":
   mode: "000644"
   owner: root
   group: root
   content: |
     # modification No.1
      map $status $logflag {
          404 0;
          403 0;
          default 1;
      }

      map $http_upgrade $connection_upgrade {
          default        "upgrade";
          ""            "";
      }

      server {
          listen 80;

          gzip on;
              gzip_comp_level 4;
              gzip_types text/html text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;

          if ($time_iso8601 ~ "^(\d{4})-(\d{2})-(\d{2})T(\d{2})") {
              set $year $1;
              set $month $2;
              set $day $3;
              set $hour $4;
          }

          # modification No.2
          # access_log /var/log/nginx/healthd/application.log.$year-$month-$day-$hour healthd;
            access_log /var/log/nginx/healthd/application.log.$year-$month-$day-$hour healthd if=$logflag;

          access_log    /var/log/nginx/access.log;

          location / {
              proxy_pass            http://docker;
              proxy_http_version    1.1;

              proxy_set_header    Connection            $connection_upgrade;
              proxy_set_header    Upgrade                $http_upgrade;
              proxy_set_header    Host                $host;
              proxy_set_header    X-Real-IP            $remote_addr;
              proxy_set_header    X-Forwarded-For        $proxy_add_x_forwarded_for;
          }
      }

该配置将用您定义的内容替换默认的/etc/nginx/sites-enabled/ellasticBeanstalk-nginx-docker-proxy.conf文件。我所做的修改是：

• No.1：添加了map指令，它将$status映射到$logflag。当请求为404或403时，将$logflag设置为0。将1设置为其他状态。
• No.2:在access_log[2]指令中添加了if=$logflag。仅当HTTP状态不是404或403时写入healthd监视日志。