Changing deny all to nginx 444 drop connection

grl570810

Apologies if this has been asked and answered.
My error logs are being flooded with 'access denied by rule' entries as the bad guys are trying to break into my server. I also have some real issues I'm trying to track down but can't see the wood for the trees.
I'm looking at the locations-wo.conf file where I assume the rules are stored, and thinking that I can suppress all the access denied log entries by changing some of the 'deny all;' lines to 'return 444;', the nginx silent drop connection code.
Before I do that:

am I correct in that assumption?
has this been done by others, is it safe?
is editing locations-wo.conf the way to go? (I know it will be overwritten when wo updates, I can cope with that)
alternatively should I instead create an extra .conf file with the changed location blocks that will load after & override locations-wo.conf. If so, where should I place it?

Thanks in advance.
Graham

marty

Not sure that's the best approach. Is the problem just trying to see the log entries you want to see? If so try filtering out the rules you don't want, e.g.
grep -v "access denied by rule" /var/log/nginx/yoursite.com.error.log

grl570810

It's partly the pain of having to filter that's the issue,
But I also think that providing a 403 response to the bad guys trying to trawl the sites is giving them more respect and information than they merit, plus requires more server resource. A 444 that just slams the connection shut with no content returned is much more effective to my mind as a "f**k you", you never know it may even discourage some of them from bothering my server.
So if I do decide to go that path, would an edit of locations-wo.conf be appropriate, or is there a better method?

marty

Yeah, I think locations-wo.conf is probably the best way if you want to go that route (but create a locations-wo.conf.custom to prevent it getting overwritten by updates, and check for changes after future updates).

But I'd be inclined to see if the root cause can be reduced/removed first. Cloudflare and Fail2ban can get rid of a lot/most of this stuff depending on what it is.