Mischievous Behavior Detected 🔎
It all started when I discovered an anonymous user was uploading a file with a strange extension and then trying to execute it.
Disclaimer: It's called experimental microserver for a reason. I am learning. My firewall was clearly lacking. Honestly I'm glad this happened. Let me explain why.
On my new mission to tighten up security, I wanted a dashboard to learn about my server traffic. I got that setup and working nicely, building a child spawned from Go Access data. During this time, I discovered this 'malicious' photo uploading activity. I was not expecting this. I went down a semi-lengthy dashboard building process. I learned so much about what "suspicious activity" or "red flags" might be. It was very eye-opening and I learned a lot about general web traffic.
High Level Understanding - What IPs Should be Blocked?
I found ways to sort the activity, giving me starting criteria for considering blocking. Loosely put, its sort of some combination of:
- IP addresses that try visiting routes that don't exist. 404 flag.
- IP addresses snooping for places to upload things or search for .env files. Snooper flag.
- IP addresses that make any attempt to access or change anything on your server that they should not. These are offenders. They get the "Tamper" flag.
The flags are assigned automatically in the dashboard to help me understand who is doing what at a very far distance.
The ban hole:
Don't Accidentally Ban Yourself
Important: You may need to tweak your filtering so that you don't block IP addresses that look 'bad' on a high level, but are actually very important. 😂 Don't ban yourself from yourself. I almost did that!
At the top of my dashboard I've added a block button, and for rage-mode, multi-block. I have now made blocking IP addresses a fun game I suppose.
I also created an incident report area to track the worst just for fun.
I learned about the types of rules one might want to create for their firewall based on how the "bad" IP addresses are trying to interact with your system. I've created certain auto-ban rules after examining the traffic. That's cool. It's nice to know why you are doing something, why it's important.
Experience is the best teacher. There is web development, and then there is security. When you have a server, you must do both. You don't built a castle and leave all the doors unlocked. Nobody would.
Recommendations from Learning
I recommend checking out https://www.abuseipdb.com/ for a free API key! You can easily set that up on your own. I found them to be an excellent starting resource for answers.
Top comments (0)