Unauthorized access attacks - SSRF?

[kam1kaze911]

Hi,

since december I am getting a lot of access errors with urls trying to pull access information from HFS or the System.
Sometimes there are only two requests and sometimes every second. Also the requests coming from different IPs, not matched with any successful authentication (access log).
The antidos plugin is running, but 10 requests in 10 seconds could affect users, currently set to 50 in 10s.

I am running Bitdefender on the server and it has warnings about exploit attempts and botnet behaviour aswell (matched IPs).
Anyone experiencing similar behaviour? Should I prepare for ramping up the security?
Would it be possible to block requests with urls not related to the HFS subsystem?

Example from the log:

[rejetto]

the best thing i know that you can do is to have some domain (even free ones), and tell HFS to block requests.

having those errors 404 is not a real security problem, but sure you live better without.

[rejetto]

i decided to create a page
https://github.com/rejetto/hfs/wiki/Tip:-avoid-spam

[kam1kaze911]

Thanks for that!

So I try not to worry any more about those scanners. HTTPS and proper authentication should do the rest.
Worst case would be a different port - as you suggest.

@rejetto use shodan.io to detect HFS instances:
https://www.shodan.io/search?query=hfs_%24id%3D

[rejetto]

that's a neat trick, and thanks for the donation!