It was online for 3 seconds before getting a 404 request for /.git/config

Re:It was online for 3 seconds before getting a 404 request ... by kstrauser on Thursday May 16, 2024 @10:12PM (#40385643)

Hey, it's me!

I'd added a new hostname to a long-existing domain. Then I added that hostname as a new virtual host to a Caddy server I've been running for a long time. The requests were to that vhost, i.e. using the `Host: my-new-host.example.com` header, not just running `curl http://1.2.3.4`. They were asking for the brand-new host by name.

After hashing it out with some friends on Mastodon, I think it's most likely because Caddy acquired a Let's Encrypt cert, those certs are logged[0], and attackers pounce on new hosts as soon as they're in the logs.

[0]https://letsencrypt.org/docs/ct-logs/

[ Parent | on HN ]

Re:It was online for 3 seconds before getting a 404 request ... by wrs on Thursday May 16, 2024 @10:34PM (#40385780)

Yes, this is a downside of certificate transparency. Also, using Let’s Encrypt certs for internal hosts, as some do for convenience, means you’re publishing your internal hostnames. Use an internal CA if that worries you.

[ Parent | on HN ]

Re:It was online for 3 seconds before getting a 404 request ... by singron on Thursday May 16, 2024 @10:53PM (#40385910)

If you care, you can use a wildcard cert. E.g. instead of getting a cert for foo.example.com, get one for *.foo.example.com, and then use an obscure subdomain. AFAIK, nobody is bruteforcing subdomains on wildcard certs.

[ Parent | on HN ]

Re:It was online for 3 seconds before getting a 404 request ... by bradtheappguy on Thursday May 16, 2024 @10:58PM (#40385940)

They are

[ Parent | on HN ]

Re:It was online for 3 seconds before getting a 404 request ... by thwarted on Thursday May 16, 2024 @11:23PM (#40386066)

Are they brute forcing them, or are they relying on the fact that most users of wildcard certs also have wildcard DNS entries, so it's just that everything is actually available. Wildcard DNS pointing to a web server with a wildcard cert will pass through to the web server, and at that point the web server responds with a 404 if the host header isn't one configured for virtual hosts.

[ Parent | on HN ]

Re:It was online for 3 seconds before getting a 404 request ... by ffsm8 on Friday May 17, 2024 @10:05AM (#40390066)

Didn't the wildcard cert still need the alt-names specifying the host for the browser to accept the certificate as fully valid? I remember being annoyed by warnings until I added them a decade ago while playing around with a private CA at a previous job

[ Parent | on HN ]

Re:It was online for 3 seconds before getting a 404 request ... by dilyevsky on Friday May 17, 2024 @07:12PM (#40395029)

Yes, /cn is deprecated. But letsencrypt adds your wildcard into subjAltNames as well and it works great.

[ Parent | on HN ]

Re:It was online for 3 seconds before getting a 404 request ... by kstrauser on Thursday May 16, 2024 @10:54PM (#40385919)

Great point. This was no big deal for me today. I was prepared for it. I mainly posted this to warn others: if you put a server online, it will be attacked, and it's going to be way sooner than you would have believed. You can't get away with, "yeah, I know I left some extra files laying around, but I'll clean them up and lock everything down as soon as I'm finished with the setup." Nope. That's not an option.

[ Parent | on HN ]

Re:It was online for 3 seconds before getting a 404 request ... by jonotime on Thursday May 16, 2024 @10:52PM (#40385903)

yup its lets encrypt. they publish the new certs to a list anyone can pull

[ Parent | on HN ]

Re:It was online for 3 seconds before getting a 404 request ... by ehPReth on Thursday May 16, 2024 @11:10PM (#40385991)

all publicly trusted CAs (that want to work in browsers?) do this

[ Parent | on HN ]