| # This sample configuration makes extensive use of the ACLs. It requires |
| # HAProxy version 1.3.12 minimum. |
| |
| global |
| log loghost local0 |
| log localhost local0 err |
| maxconn 250 |
| uid 71 |
| gid 71 |
| chroot /var/empty |
| pidfile /var/run/haproxy.pid |
| daemon |
| quiet |
| |
| frontend http-in |
| bind :80 |
| mode http |
| log global |
| clitimeout 30000 |
| option httplog |
| option dontlognull |
| #option logasap |
| option httpclose |
| maxconn 100 |
| |
| capture request header Host len 20 |
| capture request header User-Agent len 16 |
| capture request header Content-Length len 10 |
| capture request header Referer len 20 |
| capture response header Content-Length len 10 |
| |
| # block any unwanted source IP addresses or networks |
| acl forbidden_src src 0.0.0.0/7 224.0.0.0/3 |
| acl forbidden_src src_port 0:1023 |
| block if forbidden_src |
| |
| # block requests beginning with http:// on wrong domains |
| acl dangerous_pfx url_beg -i http:// |
| acl valid_pfx url_reg -i ^http://[^/]*1wt\.eu/ |
| block if dangerous_pfx !valid_pfx |
| |
| # block apache chunk exploit, ... |
| acl forbidden_hdrs hdr_sub(transfer-encoding) -i chunked |
| acl forbidden_hdrs hdr_beg(host) -i apache- localhost |
| |
| # ... some HTTP content smugling and other various things |
| acl forbidden_hdrs hdr_cnt(host) gt 1 |
| acl forbidden_hdrs hdr_cnt(content-length) gt 1 |
| acl forbidden_hdrs hdr_val(content-length) lt 0 |
| acl forbidden_hdrs hdr_cnt(proxy-authorization) gt 0 |
| block if forbidden_hdrs |
| |
| # block annoying worms that fill the logs... |
| acl forbidden_uris url_reg -i .*(\.|%2e)(\.|%2e)(%2f|%5c|/|\\\\) |
| acl forbidden_uris url_sub -i %00 <script xmlrpc.php |
| acl forbidden_uris path_end -i /root.exe /cmd.exe /default.ida /awstats.pl .asp .dll |
| |
| # block other common attacks (awstats, manual discovery...) |
| acl forbidden_uris path_dir -i chat main.php read_dump.php viewtopic.php phpbb sumthin horde _vti_bin MSOffice |
| acl forbidden_uris url_reg -i (\.php\?temppath=|\.php\?setmodules=|[=:]http://) |
| block if forbidden_uris |
| |
| # we rewrite the "options" request so that it only tries '*', and we |
| # only report GET, HEAD, POST and OPTIONS as valid methods |
| reqirep ^OPTIONS\ /.*HTTP/1\.[01]$ OPTIONS\ \\*\ HTTP/1.0 |
| rspirep ^Allow:\ .* Allow:\ GET,\ HEAD,\ POST,\ OPTIONS |
| |
| acl host_demo hdr_beg(host) -i demo. |
| acl host_www2 hdr_beg(host) -i www2. |
| |
| use_backend demo if host_demo |
| use_backend www2 if host_www2 |
| default_backend www |
| |
| backend www |
| mode http |
| source 192.168.21.2:0 |
| balance roundrobin |
| cookie SERVERID |
| server www1 192.168.12.2:80 check inter 30000 rise 2 fall 3 maxconn 10 |
| server back 192.168.11.2:80 check inter 30000 rise 2 fall 5 backup cookie back maxconn 8 |
| |
| # long timeout to support connection queueing |
| contimeout 20000 |
| srvtimeout 20000 |
| fullconn 100 |
| redispatch |
| retries 3 |
| |
| option httpchk HEAD / |
| option forwardfor |
| option checkcache |
| option httpclose |
| |
| # allow other syntactically valid requests, and block any other method |
| acl valid_method method GET HEAD POST OPTIONS |
| block if !valid_method |
| block if HTTP_URL_STAR !METH_OPTIONS |
| block if !HTTP_URL_SLASH !HTTP_URL_STAR !HTTP_URL_ABS |
| |
| # remove unnecessary precisions on the server version. Let's say |
| # it's an apache under Unix on the Formilux Distro. |
| rspidel ^Server:\ |
| rspadd Server:\ Apache\ (Unix;\ Formilux/0.1.8) |
| |
| defaults non_standard_bck |
| mode http |
| source 192.168.21.2:0 |
| option forwardfor |
| option httpclose |
| balance roundrobin |
| fullconn 100 |
| contimeout 20000 |
| srvtimeout 20000 |
| retries 2 |
| |
| backend www2 |
| server www2 192.168.22.2:80 maxconn 10 |
| |
| # end of defaults |
| defaults none |
| |
| backend demo |
| mode http |
| balance roundrobin |
| stats enable |
| stats uri / |
| stats scope http-in |
| stats scope www |
| stats scope demo |