{"action":"created","issue":{"url":"https://api.github.com/repos/nextcloud/nextcloudpi/issues/408","repository_url":"https://api.github.com/repos/nextcloud/nextcloudpi","labels_url":"https://api.github.com/repos/nextcloud/nextcloudpi/issues/408/labels{/name}","comments_url":"https://api.github.com/repos/nextcloud/nextcloudpi/issues/408/comments","events_url":"https://api.github.com/repos/nextcloud/nextcloudpi/issues/408/events","html_url":"https://github.com/nextcloud/nextcloudpi/issues/408","id":296331923,"number":408,"title":"deny access from apache using public IP","user":{"login":"testbird","id":2182535,"avatar_url":"https://avatars0.githubusercontent.com/u/2182535?v=4","gravatar_id":"","url":"https://api.github.com/users/testbird","html_url":"https://github.com/testbird","followers_url":"https://api.github.com/users/testbird/followers","following_url":"https://api.github.com/users/testbird/following{/other_user}","gists_url":"https://api.github.com/users/testbird/gists{/gist_id}","starred_url":"https://api.github.com/users/testbird/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/testbird/subscriptions","organizations_url":"https://api.github.com/users/testbird/orgs","repos_url":"https://api.github.com/users/testbird/repos","events_url":"https://api.github.com/users/testbird/events{/privacy}","received_events_url":"https://api.github.com/users/testbird/received_events","type":"User","site_admin":false},"labels":[{"id":537933287,"url":"https://api.github.com/repos/nextcloud/nextcloudpi/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":15,"created_at":"2018-02-12T10:48:56Z","updated_at":"2018-02-15T10:53:39Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"I found many unsolicited access attemps even in the NC admin interface log complaining about \"secure domain\" failures. These were requests using the external IP as domain.\r\n\r\nInstead of having apache listening and NC block these request, maybe apached could be configured right away to only answer requests using IPs (instead of dns domain names) if they are  local IPs.\r\n\r\nHere is an example restricting request based on the source IP, which is another thing, but maybe the same ranges can be used to bypass a \"apache secure domains configuration\"\r\nhttps://salsa.debian.org/freedombox-team/plinth/commit/21d6174ba052e22926f05b0a6806e3fa7f83c8f1"},"comment":{"url":"https://api.github.com/repos/nextcloud/nextcloudpi/issues/comments/365892224","html_url":"https://github.com/nextcloud/nextcloudpi/issues/408#issuecomment-365892224","issue_url":"https://api.github.com/repos/nextcloud/nextcloudpi/issues/408","id":365892224,"user":{"login":"testbird","id":2182535,"avatar_url":"https://avatars0.githubusercontent.com/u/2182535?v=4","gravatar_id":"","url":"https://api.github.com/users/testbird","html_url":"https://github.com/testbird","followers_url":"https://api.github.com/users/testbird/followers","following_url":"https://api.github.com/users/testbird/following{/other_user}","gists_url":"https://api.github.com/users/testbird/gists{/gist_id}","starred_url":"https://api.github.com/users/testbird/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/testbird/subscriptions","organizations_url":"https://api.github.com/users/testbird/orgs","repos_url":"https://api.github.com/users/testbird/repos","events_url":"https://api.github.com/users/testbird/events{/privacy}","received_events_url":"https://api.github.com/users/testbird/received_events","type":"User","site_admin":false},"created_at":"2018-02-15T10:53:39Z","updated_at":"2018-02-15T10:53:39Z","author_association":"CONTRIBUTOR","body":"No, i actually just commented out \"Require host localhost\", it checks the domain of the ip the request is comming from, and reverse lookup does not work for every ip, and not at all in the docker container.\r\n\r\nThe solution to this issue is, as in the linked answers above, have a first \"dummy\" virtualhost block everything (it gets used as fallback for non defined virtual hosts)."}}
{"actor":{"display_login":"testbird"}}