Good morning,

i've notice on my firewall some strange connections (denied) starting from an nginx based reverse proxy located in a dmz.
Connections starts from the machine and point some random ips and port all over the world (on common ports like 21, 6667, 22, etc.).
This nginx is configured only as reverse proxy without any cgi and htdocs installed so can be this an exploit?

Debian 10.6
Nginx 1.18.0 (from the official apt repos)

Thanks in advance for your help

gibo Wrote:
-------------------------------------------------------
> Good morning,
>
> i've notice on my firewall some strange connections (denied) starting
> from an nginx based reverse proxy located in a dmz.
> Connections starts from the machine and point some random ips and port
> all over the world (on common ports like 21, 6667, 22, etc.).
> This nginx is configured only as reverse proxy without any cgi and
> htdocs installed so can be this an exploit?
>
> Debian 10.6
> Nginx 1.18.0 (from the official apt repos)
>
> Thanks in advance for your help


Obviously i've checked and the connections was mad from an nginx worker process.

Sounds like a compromised system.

https://debian-handbook.info/browse/stable/sect.dealing-with-compromised-machine.html

---
nginx for Windows http://nginx-win.ecsds.eu/

Yes it is. But the question is: can be compromised by an nginx exploit? It's the only service installed and without any site hosted directly. Only proxied sites.

Can be anything, least likely nginx itself but more a bad configuration or someone had access and simply changed stuff.

---
nginx for Windows http://nginx-win.ecsds.eu/

It's very abnormal. Only public ports are 80 and 443 and checked by an ngf. What bad configuration can set nginx to open connections to ips and ports starting from a request on port 80/443? There's some specific settings i can check?

Restore from last known good backup or rebuild, it's pointless guessing.

---
nginx for Windows http://nginx-win.ecsds.eu/