Req: nginx config update to block xmlrpc.php attack

Unsupported Modifications
1

Checking nginx access logs, I was getting flooded with xmlrpc POSTs.

I added this code into server nginx, but was quickly removed by update. I can h4ck to update after system-checks nightly if not exists, but would rather see this added to config file.

Is this a reasonable request?

 location = /xmlrpc.php {
        deny all;
        access_log off; #to prevent from filling up the access log file
    }
2

No, I think it would be confusing for people if their logs didn’t actually log everything.

3

I’m confused, is the xmlrpc.php related to a log? If not, then the response seems besides the point…

location = /xmlrpc.php {
    deny all;
}
4

instead of putting that code directly into /etc/nginx/conf.d/local.conf, I think, and someone correct me if I am wrong, but if you put that code or any code for that matter, into: /root/mailinabox/conf/nginx-alldomains.conf then do a web update. The main /etc/nginx/conf.d/local.conf will reflect your changes even if there is an update. I have not done this but looking at the files in /root/mailinabox/conf/ It looks to me like they are templates that make up the main nginx conf file.

1 Like
5

Very good to know, I will try and check in a couple of days to see if it reverted. It seems this would work until an updated version of MIAB itself is installed.

6

This topic was automatically closed after 61 days. New replies are no longer allowed.