首页 注册 登录
V2EX = way to explore
V2EX 是一个关于分享和探索的地方
现在注册
已注册用户请  登录
TradingView
广告
geeti
V2EX  ›  程序员

nginx 的 log 里有几十行 404 是自己的 ip 发起的 request

  •   
  •   geeti · 2016-08-02 04:27:27 +08:00 · 3826 次点击
    这是一个创建于 2821 天前的主题，其中的信息可能已经有所发展或是发生改变。
    比如这些 404 ，是被人黑了还是怎么？ 多谢

    access.log:104.236.202.168 - - [01/Aug/2016:02:45:10 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log:104.236.202.168 - - [01/Aug/2016:02:45:10 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0"
    access.log:104.236.202.168 - - [01/Aug/2016:02:45:10 -0400] "GET /CHANGELOG.txt HTTP/1.0" 404 177 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0"
    access.log:104.236.202.168 - - [01/Aug/2016:02:45:10 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0"
    access.log:104.236.202.168 - - [01/Aug/2016:02:45:11 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0"
    access.log:104.236.202.168 - - [01/Aug/2016:02:45:11 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0"
    access.log:104.236.202.168 - - [01/Aug/2016:02:45:11 -0400] "GET /readme.html HTTP/1.0" 404 177 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0"
    access.log:104.236.202.168 - - [01/Aug/2016:04:31:16 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.1:104.236.202.168 - - [25/Jul/2016:06:47:11 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0"
    access.log.1:104.236.202.168 - - [25/Jul/2016:06:47:11 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0"
    access.log.1:104.236.202.168 - - [25/Jul/2016:09:49:48 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.1:104.236.202.168 - - [25/Jul/2016:19:46:03 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0"
    access.log.1:104.236.202.168 - - [25/Jul/2016:19:46:03 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0"
    access.log.1:104.236.202.168 - - [26/Jul/2016:00:19:54 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.1:104.236.202.168 - - [26/Jul/2016:12:21:35 -0400] "GET /robots.txt HTTP/1.0" 404 177 "-" "Mozilla/5.0 (Windows NT 6.1) (compatible; SMTBot/1.0; +http://www.similartech.com/smtbot)"
    access.log.1:104.236.202.168 - - [26/Jul/2016:12:21:43 -0400] "GET /robots.txt HTTP/1.0" 404 177 "-" "Mozilla/5.0 (Windows NT 6.1) (compatible; SMTBot/1.0; +http://www.similartech.com/smtbot)"
    access.log.1:104.236.202.168 - - [26/Jul/2016:13:04:25 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0"
    access.log.1:104.236.202.168 - - [26/Jul/2016:13:04:25 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0"
    access.log.1:104.236.202.168 - - [27/Jul/2016:04:38:51 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.1:104.236.202.168 - - [27/Jul/2016:11:39:50 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0"
    access.log.1:104.236.202.168 - - [27/Jul/2016:11:39:50 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0"
    access.log.1:104.236.202.168 - - [27/Jul/2016:14:57:53 -0400] "GET /robots.txt HTTP/1.0" 404 177 "-" "CSS Certificate Spider ( http://www.css-security.com/certificatespider/)";
    access.log.1:104.236.202.168 - - [28/Jul/2016:07:03:25 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.1:104.236.202.168 - - [29/Jul/2016:05:38:13 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.1:104.236.202.168 - - [29/Jul/2016:22:53:11 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.1:104.236.202.168 - - [31/Jul/2016:00:22:54 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.2:104.236.202.168 - - [18/Jul/2016:04:51:22 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.2:104.236.202.168 - - [19/Jul/2016:08:36:49 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.2:104.236.202.168 - - [19/Jul/2016:21:20:27 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.2:104.236.202.168 - - [20/Jul/2016:14:29:00 -0400] "GET /robots.txt HTTP/1.0" 404 177 "-" "CSS Certificate Spider ( http://www.css-security.com/certificatespider/)";
    access.log.2:104.236.202.168 - - [21/Jul/2016:03:21:34 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.2:104.236.202.168 - - [21/Jul/2016:04:24:28 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.2:104.236.202.168 - - [21/Jul/2016:04:24:29 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:43.0) Gecko/20100101 Firefox/43.0"
    access.log.2:104.236.202.168 - - [21/Jul/2016:04:24:29 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:43.0) Gecko/20100101 Firefox/43.0"
    access.log.2:104.236.202.168 - - [21/Jul/2016:04:24:29 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:43.0) Gecko/20100101 Firefox/43.0"
    access.log.2:104.236.202.168 - - [21/Jul/2016:04:24:30 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:43.0) Gecko/20100101 Firefox/43.0"
    access.log.2:104.236.202.168 - - [21/Jul/2016:04:24:31 -0400] "GET /readme.html HTTP/1.0" 404 177 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:43.0) Gecko/20100101 Firefox/43.0"
    access.log.2:104.236.202.168 - - [21/Jul/2016:04:24:31 -0400] "GET /CHANGELOG.txt HTTP/1.0" 404 177 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:43.0) Gecko/20100101 Firefox/43.0"
    access.log.2:104.236.202.168 - - [21/Jul/2016:22:57:29 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.2:104.236.202.168 - - [22/Jul/2016:20:53:07 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.2:104.236.202.168 - - [24/Jul/2016:01:53:33 -0400] "GET /admin/i18n/readme.txt HTTP/1.0" 404 177 "-" "python-requests/2.8.0"
  • 104.236.202.168
  • log
  • Access
  • Jul
    20 条回复  •  2016-08-03 17:14:40 +08:00
    eastpiger
        1
    eastpiger  
       2016-08-02 05:59:43 +08:00
    你是不是用了反代？
    geeti
        2
    geeti  
    OP
       2016-08-02 09:19:10 +08:00
    @eastpiger 都不知道是什么。
    nodejs 的监听端口是 3000 ，用 iptables 把 80 重定向到 3000.这算反向代理不？

    即使是这样，那些奇怪的请求是怎么回事？
    谢谢
    yuankui
        3
    yuankui  
       2016-08-02 09:28:23 +08:00   ❤️ 1
    这些问题建议楼主多学点 http ， web 的知识之后再来问~
    jimzhong
        4
    jimzhong  
       2016-08-02 09:36:04 +08:00
    @geeti iptables 重定向不算反代
    geeti
        5
    geeti  
    OP
       2016-08-02 09:42:21 +08:00   ❤️ 3
    @yuankui 我就是问问，您要是愿意指点自然感谢，不愿意也不需要高屋建瓴的给我指导人生方向。乌烟瘴气的环境就是你这种人太多
    serial
        6
    serial  
       2016-08-02 10:31:43 +08:00
    你的静态文件都没有加相对主目录。

    location ~ \.(html|txt)$ 中放上 root
    ayaseangle
        7
    ayaseangle  
       2016-08-02 10:33:41 +08:00
    暴露给外网了吗？估计被扫描了。。
    geeti
        8
    geeti  
    OP
       2016-08-02 10:59:33 +08:00
    @ayaseangle 一个 vps 而已，前一阵子被一些地方推荐，导致每天几千流量。 DDOS 少不了，但是不懂的是为啥会有自己的 public ip 来进行 http request
    lhbc
        9
    lhbc  
       2016-08-02 11:38:13 +08:00
    你没留意到所有的 client ip 都是你自己的服务器 IP 吗？
    sobigfish
        10
    sobigfish  
       2016-08-02 12:03:02 +08:00
    @geeti 他给你指了学习的方向，而不是回答问题 也没什么错吧。。。
    geeti
        11
    geeti  
    OP
       2016-08-02 12:55:38 +08:00 via iPad
    @lhbc 所以我才发这个贴问原因啊。。。为啥？虚心请教
    lhbc
        12
    lhbc  
       2016-08-02 13:04:50 +08:00 via Android
    @geeti 所以，根本不是 404 或者被黑的问题，你的问题应该是“为什么日志里所有的访问者 IP 都是服务器 IP ”
    完全 get 不到你提问的点……

    80 端口用 nginx 做反向代理，用 nginx 记录日志
    iptables 不是干这个用的
    yuankui
        13
    yuankui  
       2016-08-02 13:46:33 +08:00
    我如果直接告诉你 [不是] 结果又能怎样？你是什么水平还是什么水平，你的脑袋一样会很多很多问题，而这些问题你极有可能再开一贴，让大家给你答案。
    与其这样，还是建议你自己多学点，这些基础问题小白问题，就不攻自破了。
    geeti
        14
    geeti  
    OP
       2016-08-02 22:43:21 +08:00
    @lhbc 谢谢。没说清楚。
    为啥 ip 会显示 server 的 ip 呢？
    我没做也没打算做反向代理，用 iptables 转到 3000 只是为了方便， nodejs 调试用的 3000 ，当时没改。但我觉得不应该是因为这个导致的。
    lhbc
        15
    lhbc  
       2016-08-02 22:59:43 +08:00
    @geeti NAT 之后 IP 会改变
    nginx 做反向代理不就是 10 行配置的事情吗
    geeti
        16
    geeti  
    OP
       2016-08-03 02:43:18 +08:00
    @lhbc 为什么这里会涉及到 NAT ？这里没有 NAT 啊， server 是 public vps
    billwsy
        17
    billwsy  
       2016-08-03 05:55:11 +08:00 via iPhone
    @geeti 80 转 3000 是个 NAT
    rogerchen
        18
    rogerchen  
       2016-08-03 09:46:51 +08:00
    @billwsy +1 正解
    libotony
        19
    libotony  
       2016-08-03 10:00:15 +08:00
    好奇怪的实现方式，建议老老实实用 nginx 做反代
    bigpigeon
        20
    bigpigeon  
       2016-08-03 17:14:40 +08:00
    我觉得应该把你的 nginx 配置也贴出来好些，只看日志很难排查
    关于   ·   帮助文档   ·   博客   ·   API   ·   FAQ   ·   我们的愿景   ·   实用小工具   ·   5337 人在线   最高记录 6543   ·     Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 · 31ms · UTC 07:04 · PVG 15:04 · LAX 00:04 · JFK 03:04
    Developed with CodeLauncher
    ♥ Do have faith in what you're doing.