背景:安全组同学使用固定user-agent去扫描我们的网站,造成告警误报,需要将相关扫描资源的状态码修改,避免无效告警
思路:在nginx请求的header_filter_by_lua阶段,将请求状态码修改为自定义状态码
直接上代码,将以下代码写入配置文件xxx.lua,在相对应的域名下引用就可以了:
header_filter_by_lua_file "xxx.lua";
local log_time = os.date("%Y-%m-%d %X",os.time())
local ngx_lua_ua_log = "/data/nginx/log/sec.lua.log"
local status = ngx.var.status
local user_agent = ngx.var.http_user_agent
local host = ngx.var.host
local function add_quote(str)
return string.format(‘"%s"‘, str)
end
local function logging(log_file, msg)
file = io.open(log_file, "a+")
file:write(msg)
file:flush()
file.close()
end
if user_agent == "xxx" and ngx.status ~= 200 then
ngx.status = "211"
local msg = table.concat({
add_quote(log_time),
add_quote(host),
add_quote(user_agent),
add_quote(ngx.status),
"\n"
}, " ")
logging(ngx_lua_ua_log, msg)
else
return
end
经过测试,所有以xxx的user-agent且状态码不为200的请求都修改为了”211“,具体情况,可以自己修改;
原文:https://blog.51cto.com/wenxi123/2716098