2 maps for one 1 variable?

Hello,

Is it possible to use more than one map directive with a single
variable? I tried but it seems the second map over writes any value set
by the 1st map even if there is no match in the 2nd map. I tried leaving
out the default value in the second map.


Cole

On Apr 1, 2015, at 3:23 PM, Steve H. [email protected]
wrote:

though.

Does that fit with what you’re trying to do??

Thank does work. Thanks!

Hello,

I’m seeing lots of shellshock probing in my access logs. My server’s not
vulnerable, but my logs are filling up with 404s. The requests are for
random cgi scripts. The referer and user_agents are the same and always
start with () { :; }; followed by curl or wget to a remote perl script
piped to perl locally. I’d like to return 444 for these.

I’m currently using a couple of maps to set a variable $drop. What would
be the most efficient way to test for the initial “() { :; };” at
beginning of these request headers? This is what I have so far:

map $http_referer $drop_referer {
    default 0;
    "~^\s*\(\s*\)\s*\{[^\}]*\}\s*"  1;
}
map $http_user_agent $drop {
    default $drop_referer;
    "~^\s*\(\s*\)\s*\{[^\}]*\}\s*"  1;
}

Or is there a better method to block these?


Cole

On Wed, 2015-04-01 at 15:05 -0400, Cole Tierney wrote:

Hello,

Is it possible to use more than one map directive with a single variable? I
tried but it seems the second map over writes any value set by the 1st map even if
there is no match in the 2nd map. I tried leaving out the default value in the
second map.


Cole
You can link 2 maps together by setting the default value for the second
map as the result from the first map. Unique names will be required
though.

Does that fit with what you’re trying to do??


Steve H. BSc(Hons) MIITP
http://www.greengecko.co.nz
Linkedin: http://www.linkedin.com/in/steveholdoway
Skype: sholdowa

Thanks mex, I’ll check it out.

hi cole,

if implemetable you couldd use naxsi https://github.com/nbs-system/naxsi
for this, there exists a rule to detect and block
shellshock-exploit-attempts:

MainRule “str:() {” “msg:Possible Remote code execution through Bash
CVE-2014-6271” “mz:BODY|HEADERS” “s:$ATTACK:8” id:42000393 ;

see -> http://spike.nginx-goodies.com/rules/view/42000393

there is also an extended ruleset available
-> https://bitbucket.org/lazy_dogtown/doxi-rules

cheers,

mex

Posted at Nginx Forum:
http://forum.nginx.org/read.php?2,257792,257796#msg-257796

if you have questions on naxsi, feel free to join the naxsi-discuss - ml

https://groups.google.com/forum/#!forum/naxsi-discuss

cheers,

mex

Posted at Nginx Forum:
http://forum.nginx.org/read.php?2,257792,257801#msg-257801

~{.:; 1;

Block shellshock:

if ($waffable) { return 444; }

Drop’m from logging:

map $waffable $loggable {
default 1;
~1 0;
}

access_log /path/to/access.log combined if=$loggable;

Thanks! I like the combined variables in the 3rd map.

That is the power of the ‘empty value = does nothing’ logic. :o)

B. R.

On Thu, Apr 2, 2015 at 3:33 PM, Cole Tierney
[email protected]

Cole Tierney Wrote:

Or is there a better method to block these?

Not really better but good enough :slight_smile:

map $http_referer $waffableref {
default 0;
~{.:; 1;
}
map $http_user_agent $waffableua {
default 0;
~{.:; 1;
}
map $waffableref$waffableua $waffable {
default 0;
~1 1;
}

Block shellshock:

if ($waffable) { return 444; }

Drop’m from logging:

map $waffable $loggable {
default 1;
~1 0;
}

access_log /path/to/access.log combined if=$loggable;

Posted at Nginx Forum:
http://forum.nginx.org/read.php?2,257792,257814#msg-257814

This forum is not affiliated to the Ruby language, Ruby on Rails framework, nor any Ruby applications discussed here.

| Privacy Policy | Terms of Service | Remote Ruby Jobs