| Willy Tarreau | b21152b | 2007-06-17 23:41:40 +0200 | [diff] [blame] | 1 | # This sample configuration makes extensive use of the ACLs. It requires |
| 2 | # HAProxy version 1.3.12 minimum. |
| 3 | |
| 4 | global |
| 5 | log loghost local0 |
| 6 | log localhost local0 err |
| 7 | maxconn 250 |
| 8 | uid 71 |
| 9 | gid 71 |
| 10 | chroot /var/empty |
| 11 | pidfile /var/run/haproxy.pid |
| 12 | daemon |
| 13 | quiet |
| 14 | |
| 15 | frontend http-in |
| 16 | bind :80 |
| 17 | mode http |
| 18 | log global |
| 19 | clitimeout 30000 |
| 20 | option httplog |
| 21 | option dontlognull |
| 22 | #option logasap |
| 23 | option httpclose |
| 24 | maxconn 100 |
| 25 | |
| 26 | capture request header Host len 20 |
| 27 | capture request header User-Agent len 16 |
| 28 | capture request header Content-Length len 10 |
| 29 | capture request header Referer len 20 |
| 30 | capture response header Content-Length len 10 |
| 31 | |
| 32 | # block any unwanted source IP addresses or networks |
| 33 | acl forbidden_src src 0.0.0.0/7 224.0.0.0/3 |
| 34 | acl forbidden_src src_port 0:1023 |
| 35 | block if forbidden_src |
| 36 | |
| 37 | # block requests beginning with http:// on wrong domains |
| 38 | acl dangerous_pfx url_beg -i http:// |
| 39 | acl valid_pfx url_reg -i ^http://[^/]*1wt\.eu/ |
| 40 | block if dangerous_pfx !valid_pfx |
| 41 | |
| 42 | # block apache chunk exploit, ... |
| 43 | acl forbidden_hdrs hdr_sub(transfer-encoding) -i chunked |
| 44 | acl forbidden_hdrs hdr_beg(host) -i apache- localhost |
| 45 | |
| 46 | # ... some HTTP content smugling and other various things |
| 47 | acl forbidden_hdrs hdr_cnt(host) gt 1 |
| 48 | acl forbidden_hdrs hdr_cnt(content-length) gt 1 |
| 49 | acl forbidden_hdrs hdr_val(content-length) lt 0 |
| 50 | acl forbidden_hdrs hdr_cnt(proxy-authorization) gt 0 |
| 51 | block if forbidden_hdrs |
| 52 | |
| 53 | # block annoying worms that fill the logs... |
| 54 | acl forbidden_uris url_reg -i .*(\.|%2e)(\.|%2e)(%2f|%5c|/|\\\\) |
| 55 | acl forbidden_uris url_sub -i %00 <script xmlrpc.php |
| 56 | acl forbidden_uris path_end -i /root.exe /cmd.exe /default.ida /awstats.pl .asp .dll |
| 57 | |
| 58 | # block other common attacks (awstats, manual discovery...) |
| 59 | acl forbidden_uris path_dir -i chat main.php read_dump.php viewtopic.php phpbb sumthin horde _vti_bin MSOffice |
| 60 | acl forbidden_uris url_reg -i (\.php\?temppath=|\.php\?setmodules=|[=:]http://) |
| 61 | block if forbidden_uris |
| 62 | |
| 63 | # we rewrite the "options" request so that it only tries '*', and we |
| 64 | # only report GET, HEAD, POST and OPTIONS as valid methods |
| 65 | reqirep ^OPTIONS\ /.*HTTP/1\.[01]$ OPTIONS\ \\*\ HTTP/1.0 |
| 66 | rspirep ^Allow:\ .* Allow:\ GET,\ HEAD,\ POST,\ OPTIONS |
| 67 | |
| 68 | acl host_demo hdr_beg(host) -i demo. |
| 69 | acl host_www2 hdr_beg(host) -i www2. |
| 70 | |
| 71 | use_backend demo if host_demo |
| 72 | use_backend www2 if host_www2 |
| 73 | default_backend www |
| 74 | |
| 75 | backend www |
| 76 | mode http |
| 77 | source 192.168.21.2:0 |
| 78 | balance roundrobin |
| 79 | cookie SERVERID |
| 80 | server www1 192.168.12.2:80 check inter 30000 rise 2 fall 3 maxconn 10 |
| 81 | server back 192.168.11.2:80 check inter 30000 rise 2 fall 5 backup cookie back maxconn 8 |
| 82 | |
| 83 | # long timeout to support connection queueing |
| 84 | contimeout 20000 |
| 85 | srvtimeout 20000 |
| 86 | fullconn 100 |
| 87 | redispatch |
| 88 | retries 3 |
| 89 | |
| 90 | option httpchk HEAD / |
| 91 | option forwardfor |
| 92 | option checkcache |
| 93 | option httpclose |
| 94 | |
| 95 | # allow other syntactically valid requests, and block any other method |
| 96 | acl valid_method method GET HEAD POST OPTIONS |
| 97 | block if !valid_method |
| 98 | block if HTTP_URL_STAR !METH_OPTIONS |
| 99 | block if !HTTP_URL_SLASH !HTTP_URL_STAR !HTTP_URL_ABS |
| 100 | |
| 101 | # remove unnecessary precisions on the server version. Let's say |
| 102 | # it's an apache under Unix on the Formilux Distro. |
| 103 | rspidel ^Server:\ |
| 104 | rspadd Server:\ Apache\ (Unix;\ Formilux/0.1.8) |
| 105 | |
| 106 | defaults non_standard_bck |
| 107 | mode http |
| 108 | source 192.168.21.2:0 |
| 109 | option forwardfor |
| 110 | option httpclose |
| 111 | balance roundrobin |
| 112 | fullconn 100 |
| 113 | contimeout 20000 |
| 114 | srvtimeout 20000 |
| 115 | retries 2 |
| 116 | |
| 117 | backend www2 |
| 118 | server www2 192.168.22.2:80 maxconn 10 |
| 119 | |
| 120 | # end of defaults |
| 121 | defaults none |
| 122 | |
| 123 | backend demo |
| 124 | mode http |
| 125 | balance roundrobin |
| 126 | stats enable |
| 127 | stats uri / |
| 128 | stats scope http-in |
| 129 | stats scope www |
| 130 | stats scope demo |