Origin Protection & Hardening¶

This page describes the security measures on the Brekz webservers FL09BRE002 and FL10BRE001 that:

• only allow web traffic that arrives through Cloudflare,
• protect the back office (/administrator/) with Cloudflare Access,
• restrict which PHP files can run,
• log every attempt to reach the servers directly, outside Cloudflare, and report those attempts weekly.

Rollout status¶

Overview¶

flowchart LR
    V[Visitor] -->|HTTPS| CF[Cloudflare edge
WAF + Access]
    CF -->|Cloudflare IP| NG
    M[Whitelisted WAN IP
e.g. Uptime Kuma] -->|direct| NG
    A[Anyone else
direct to server IP] -->|direct| NG
    subgraph NG[nginx on FL09BRE002 / FL10BRE001]
        G{geo check
$origin_allowed}
        G -->|1 = Cloudflare
2 = whitelist| VH[Virtual host]
        G -->|0 = direct| D[444 drop + log]
        CA[Catch-all default vhost
unknown host / bare IP] --> D
    end
    VH --> P{PHP file?}
    P -->|index.php, admin folder,
PhpAllowedScripts| FPM[PHP-FPM
display_errors off]
    P -->|any other .php| E[404]
    D --> L[(direct-origin.log)]
    L --> R[Weekly report
SendGrid + Slack]

Measures¶

1. Cloudflare-only access per virtual host¶

Every virtual host that has CloudflareOnly switched on checks the IP address the connection really comes from. The check uses $realip_remote_addr, which is still the real connecting IP after the realip module has replaced $remote_addr with the visitor's IP. The address is matched against a geo map:

The check covers ports 80 and 443. A spoofed X-Forwarded-For header does not help an attacker: nginx only trusts that header on connections from Cloudflare.

# Alleen via Cloudflare (+ OriginWhitelist); directe origin-pogingen loggen en droppen
access_log  /var/log/nginx/origin/direct-origin.log direct_origin if=$direct_origin;
if ($origin_allowed = 0) {
    return 444;
}

2. Whitelist for specific WAN IPs¶

Some systems legitimately connect directly, for example uptime monitoring. Their addresses are listed in OriginWhitelist. Ansible manages this list, separately from the Cloudflare ranges.

3. Catch-all default virtual host¶

A dedicated default server (000-default-catchall) answers every request that does not match a known server_name: the bare server IP, an unknown Host header, or an unknown TLS SNI name. It:

• presents a neutral self-signed certificate with a name that cannot be traced to Brekz or Flooris, so a scan of the bare IP does not reveal which sites are hosted,
• logs the request to direct-origin.log,
• closes the connection (444).

4. Automatic Cloudflare IP updates¶

Cloudflare occasionally changes its IP ranges. Every day at 04:15, cloudflare-ip-update.php (PHP 8.4 CLI) fetches the current ranges from the Cloudflare API. It then:

1. validates the response: the API call succeeded, every entry is a valid CIDR, and there are at least 10 IPv4 and 5 IPv6 ranges;
2. compares the ranges with the current geo-ranges.conf and realip.conf, and stops if nothing changed;
3. backs up both files, writes the new versions atomically and runs nginx -t;
4. reloads nginx, or restores the backup if the test fails;
5. sends a notification with the added and removed ranges, or with the error.

5. Weekly report of direct origin attempts¶

Every Monday at 08:00, report-direct-origin.php summarises the past seven days of direct-origin.log, including rotated and .gz files. The report contains:

• the total, and the count per day and per port (80/443);
• the count per target: a test vhost or the catch-all;
• the top source IPs, Host headers, SNI names, paths and user agents;
• warnings for requests that reached the catch-all through Cloudflare, which most likely means a server_name is missing;
• whitelisted IPs that hit the catch-all.

The report is stored under /var/log/nginx/origin/reports/ and a summary is sent by SendGrid (with the full report attached) and/or a Slack webhook.

6. Cloudflare Access on the back office¶

The back office path /administrator/ is protected by a Cloudflare Access application, Brekz TEST admin, on all test hostnames and shop aliases. Only @flooris.nl accounts, plus explicitly added Brekz accounts, can sign in.

Measure 1 is a precondition for this one: without it, Access could be bypassed by connecting to the server IP directly.

7. display_errors disabled¶

The PHP-FPM pools of the environment have:

php_admin_flag[display_errors] = off
php_admin_flag[display_startup_errors] = off
php_admin_flag[log_errors] = on

php_admin_flag values cannot be overridden by the application through ini_set(), nor by .user.ini files. Errors are still logged, but they are never shown to visitors, where they could reveal paths, queries or configuration.

8. PHP only through the front controller¶

With PhpFrontControllerOnly switched on, nginx only passes these PHP files to PHP-FPM:

Every other .php request returns 404, even if the file exists. That blocks direct execution of uploaded or planted scripts, such as webshells in modules/ or upload/, and of configuration files such as config/settings.inc.php. Friendly URLs still work, because they are routed through index.php. Extra scripts can be allowed per vhost with PhpAllowedScripts.

Components¶

All measures are managed with Ansible in the flooris-hosting repository, under webhosting/brekz-new/.

Operations¶

php8.4 /opt/origin-protection/report-direct-origin.php --test-notify

php8.4 /opt/origin-protection/report-direct-origin.php --no-notify --stdout   # report only
php8.4 /opt/origin-protection/report-direct-origin.php --days=30 --no-notify --stdout
php8.4 /opt/origin-protection/cloudflare-ip-update.php --dry-run              # show changes only

Known limitations and follow-up¶