3

I'm trying to deny some user agents I constantly see probing my nginx web server.

If I have this in my .conf file 

 ## Block http user agent - morpheus fucking scanner ##
    if ($http_user_agent ~* (morfeus fucking scanner|ZmEu)) {
       return 403;
    }

I get the following error when starting services:

nginx: [emerg] invalid condition "$http_user_agent" in /etc/nginx/sites-enabled/siteXXX:19
nginx: configuration file /etc/nginx/nginx.conf test failed

If I place quotation marks around it, it starts but doesn't deny as I would expect it to.

 ## Block http user agent - morpheus fucking scanner ##
    if ($http_user_agent ~* "(morfeus fucking scanner|ZmEu)") {
       return 403;
    }

Any ideas? Im looking for a case-insensitive user agent deny.

ProfessionalAmateur
  • 917
  • 5
  • 17
  • 26

2 Answers2

12

Just drop the brackets and add quotes:

if ($http_user_agent ~* "morfeus fucking scanner|ZmEu") {
    return 403;
}
mgorven
  • 30,036
  • 7
  • 76
  • 121
1

what is the string you are trying to match?

Regex should be in quotes, but if you want to match regex special symbol (,),| - you need to escape it with \

try this: $http_user_agent ~ "(morfeus fucking scanner)|ZmEu"

DukeLion
  • 3,239
  • 1
  • 17
  • 19