Re: [Sks-devel] Just coincidence or targeted attack?

[Phil Pennock]

On 2014-05-19 at 19:12 +0200, Tobias Frei wrote:
> ...about every five seconds. The connections appear to come from
> 127.0.0.1 because of the reverse proxying; nginx's access logs are
> disabled for this host and I don't think that enabling them will help
> here at all. All I could get is a list of abusive IP addresses, which
> might change frequently - and these requests don't cause any trouble
> for me anyway. The logs are rotated and compressed automatically, so
> I'll just ignore these requests.

You don't need to enable nginx logs, if you just set up nginx to include
IP information in a header.  An X-Real-IP: header will be included in
the db.log for any event which triggers a request dump to logs at your
log level.

----------------------------8< cut here >8------------------------------
2014-05-15 14:35:35 Error handling request (POST,/pks/add,[
accept:*/*
connection:close
content-length:82
content-type:application/x-www-form-urlencoded
host:pool.sks-keyservers.net:11371
x-forwarded-for:2001:16d8:ee00:58::2
x-real-ip:2001:16d8:ee00:58::2]): Failure("Error while decoding ascii-armored 
key: text terminated before beginning of ascii block")
----------------------------8< cut here >8------------------------------

Reverse DNS on that IPv6 address points to SixXS in Norway, hanging off
an Oslo PoP (given that network engineers often name devices/zones by
the nearest airport's IATA code, since it works for an easy scheme to
get a short code which is globally unique but identifies the locality).

    ... domain name pointer cl-89.osl-01.no.sixxs.net.


The configuration in
  <https://bitbucket.org/skskeyserver/sks-keyserver/wiki/Peering>
is a minimum to interoperate, not a "you must or should use exactly
this"; my actual configuration is:

----------------------------8< cut here >8------------------------------
    # HKP
    server {
        listen      94.142.242.225:11371;
        listen      [2a02:898:31:0:48:4558:73:6b73]:11371;
        access_log  off;
        # Like `include fragment-pks;` but for `/`:
        location / {
            proxy_pass         http://127.0.0.3:11371;
            proxy_set_header   Host            $host:$server_port;
            proxy_set_header   X-Real-IP       $remote_addr;
            proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_pass_header  Server;
            add_header         Via "1.1 sks.spodhuis.org:11371 (nginx)";
            proxy_ignore_client_abort on;
            client_max_body_size 8m;
        }
    }
----------------------------8< cut here >8------------------------------

and every vhost for other hostnames or ports has `include fragment-pks;`
inside the `server { ... }` block; that include file is simply:

----------------------------8< cut here >8------------------------------
# Pass /pks onto the SKS keyserver
location /pks {
    proxy_pass         http://127.0.0.3:11371;
    proxy_set_header   Host            $host:$server_port;
    proxy_set_header   X-Real-IP       $remote_addr;
    proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_pass_header  Server;
    add_header         Via "1.1 $server_name:$server_port (nginx)";
    proxy_ignore_client_abort on;
    client_max_body_size 8m;
}
----------------------------8< cut here >8------------------------------

This brings the number of places where the content is repeated down to
2, which is almost the ideal of 1.  Note the differences in the Via:
header construction.

-- 
My employer, Apcera Inc, is hiring sysadmin; primarily San Francisco:
 http://www.apcera.com/jobs/#operations-engineer
(but all the mistakes in this email are made in my personal capacity)

pgpg24vVTZxUw.pgp
Description: PGP signature