0

I installed Nagios recently on a Debian machine running an Apache web server among other things.

The thing is that lately, Nagios tells me that the HTTP service is failing intermittently and it seems that, at random moments, the server gets A TON of connections from its external address and a whole lot of apache2 processes start literally forking my computer up the arse.

To explain this, imagine my public IP address is 1.2.3.4 and I have a webserver running in a LAN in 192.168.0.10 and 192.168.0.1 is a router that NAT's the http traffic in and out.

Whenever the event occurs I see (through netstat) a lot of tcp connections in ESTABLISHED state from 192.168.0.10:randomport to 1.2.3.4:80 (Outgoing connections?) and another ton of tcp6 connections also in ESTABLISHED state from 1.2.3.4:randomport to 192.168.0.10:80.

I really don't know what is going on, with a regular DDoS I'd expect multiple foreign addresses but not my own public IP address.

The thing is that I don't know if it's Nagios itself that may be causing this or it had been happening before and I didn't know it.

Anyone has any idea about what might be going on?

Thanks a lot

PD: ATM I put an iptables rule and it seems that it fixes it without affecting the service, but I want to know what is behind this, so I'm deleting the rule for further tests.

PD2: Further analysis of a netstat output shows that the randomports match between IP's so it seems that my machine is DoSing itself out of misery? Running the check_http nagios plugin when the machine is not busy works correctly and doesn't cause the event, so something else must be doing it, any ideas on how to narrow it?

EDIT: ss revealed that the ones ORIGINATING the connections are apache2 processes, so basically apache2 is just making connnections to itself?

Keith
  • 4,627
  • 14
  • 25
Imanol Barba Sabariego
  • 3
  • 7

1 Answers1

0

Ok, I managed to reproduce the problem by browsing the webserver using localhost and it triggered the event. I had some RewriteCond rules that read the %{HTTP_HOST} variable, and when that host isn't one of the ServerName or ServerAlias it wrought havoc somehow.

I had an entry on /etc/hosts that linked the hostname used by nagios's check_http plugin as hostaddress to 127.0.1.1 and it was causing this whole ruckus.

Now it doesn't happen and luckily the events should stop happening.

I hope it helps somebody.

Imanol Barba Sabariego
  • 3
  • 7