Planet CakePHP

I was noticing my nginx log file fill up with requests for a site who had misconfigured their DNS. Normally I wouldn’t worry about it, but it became quickly evident that the domain was used for an image server for a parent site. There were thousands of RPS that I really didn’t need.
All I did was add the following expression to my nginx.conf file.

Server {
 
...snip...
 
## Deny illegal Host headers
if ($host !~* ^(mydomain.com|www.mydomain.com)$ ) {
return 444;
}
 
...snip...
 
}

Now if you look at the code, you may be thinking “But Jared, what is a 444 error? That is totally not valid bro.” And indeed, you are correct. But here is what the nginx documentation has to say about it.
“Furthermore, nonstandard code 444 closes the connection without sending any headers.”
So basically, my expression above, in plain english, is saying.
“If you are not making a request using the valid hostname of my server, then I’m just going to close the connection and return you nothing. nada. zip.”
For the record, I got a lot of value out of this article over @ calomel.org, but the site seems to have issues so I copy/pasted their nginx.conf file here for historical purposes.

## Compression
gzip on;
gzip_static on;
gzip_buffers 16 8k;
gzip_comp_level 9;
gzip_http_version 1.0;
gzip_min_length 0;
gzip_types text/plain text/html text/css image/x-icon image/bmp;
gzip_vary on;
 
## Log Format
log_format main '$remote_addr $host $remote_user [$time_local] "$request"
$status $body_bytes_sent "$http_referer" "$http_user_agent" $ssl_cipher $request_time';
 
## Deny access to any host other than (www.)mydomain.com
server {
server_name _; #default
return 444;
}
 
## Server (www.)mydomain.com
server {
add_header Cache-Control public;
access_log /var/log/nginx/access.log main buffer=32k;
error_log /var/log/nginx/error.log info;
expires 31d;
limit_conn gulag 5;
listen 127.0.0.1:8080 rcvbuf=64k backlog=128;
root /htdocs;
server_name mydomain.com www.mydomain;
 
## Only allow GET and HEAD request methods
if ($request_method !~ ^(GET|HEAD)$ ) {
return 444;
}
 
## Deny illegal Host headers
if ($host !~* ^(mydomain.com|www.mydomain.com)$ ) {
return 444;
}
 
## Deny certain User-Agents (case insensitive)
## The ~* makes it case insensitive as opposed to just a ~
if ($http_user_agent ~* (Baiduspider|Jullo) ) {
return 444;
}
 
## Deny certain Referers (case insensitive)
## The ~* makes it case insensitive as opposed to just a ~
if ($http_referer ~* (babes|click|diamond|forsale|girl|jewelry|love|nudit|organic|poker|porn|poweroversoftware|sex|teen|video|webcam|zippo) ) {
return 444;
}
 
## Redirect from www to non-www
if ($host = 'www.mydomain.com' ) {
rewrite ^/(.*)$ http://mydomain.com/$1 permanent;
}
 
## Stop Image and Document Hijacking
location ~* (\.jpg|\.png|\.css)$ {
if ($http_referer !~ ^(http://mydomain.com) ) {
return 444;
}
}
 
## Restricted Access directory
location ^~ /secure/ {
allow 127.0.0.1/32;
allow 10.10.10.0/24;
deny all;
auth_basic "RESTRICTED ACCESS";
auth_basic_user_file /var/www/htdocs/secure/access_list;
}
 
## Only allow these full URI paths relative to document root. If you only want
## to reference the filename use $request_filename instead of $request_uri
location / {
if ($request_uri ~* (^\/|\.html|\.jpg|\.org|\.png|\.css|favicon\.ico|robots\.txt)$ ) {
break;
}
return 444;
}
 
## Serve an empty 1x1 gif _OR_ an error 204 (No Content) for favicon.ico
location = /favicon.ico {
#empty_gif;
return 204;
}
 
## System Maintenance (Service Unavailable)
if (-f $document_root/system_maintenance.html ) {
error_page 503 /system_maintenance.html;
return 503;
}
 
## All other errors get the generic error page
error_page 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 495 496 497
500 501 502 503 504 505 506 507 /error_page.html;
location /error_page.html {
internal;
}
}
}
#
#######################################################
### Calomel.org /etc/nginx.conf END
#######################################################