ENVIRONMENT:
ID_LIKE="rhel fedora"
CentOS Linux 7 (Core)
Python 3.7.9
PROBLEM:
When I open a specific page on my Flask web app, I get this error message:
502 Bad Gateway
WHAT I DID :
I check the logs:
/www/wwwlogs/access.log
152.32.150.7 - - [07/Sep/2023:05:56:59 +0000] "GET /robots.txt HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11"
152.32.150.7 - - [07/Sep/2023:05:56:59 +0000] "GET /sitemap.xml HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11"
185.161.248.31 - - [07/Sep/2023:08:30:43 +0000] "\x03\x00\x00/*\xE0\x00\x00\x00\x00\x00Cookie: mstshash=Administr" 400 150 "-" "-"
205.210.31.228 - - [07/Sep/2023:11:08:13 +0000] "GET / HTTP/1.1" 403 146 "-" "Expanse, a Palo Alto Networks company, searches across the global IPv4 space multiple times per day to identify customers' presences on the Internet. If you would like to be excluded from our scans, please send IP addresses/domains to: [email protected]"
104.140.148.82 - - [07/Sep/2023:11:19:54 +0000] "GET /UEPs HTTP/1.1" 404 146 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"
45.227.254.49 - - [07/Sep/2023:12:03:24 +0000] "\x03\x00\x00/*\xE0\x00\x00\x00\x00\x00Cookie: mstshash=Administr" 400 150 "-" "-"
185.11.61.122 - - [07/Sep/2023:13:21:38 +0000] "\x03\x00\x00/*\xE0\x00\x00\x00\x00\x00Cookie: mstshash=Administr" 400 150 "-" "-"
171.67.70.84 - - [07/Sep/2023:15:34:20 +0000] "GET / HTTP/1.1" 403 146 "-" "Mozilla/5.0 zgrab/0.x"
185.11.61.122 - - [07/Sep/2023:23:53:42 +0000] "\x03\x00\x00/*\xE0\x00\x00\x00\x00\x00Cookie: mstshash=Administr" 400 150 "-" "-"
45.227.254.49 - - [08/Sep/2023:12:30:39 +0000] "\x03\x00\x00/*\xE0\x00\x00\x00\x00\x00Cookie: mstshash=Administr" 400 150 "-" "-"
198.235.24.123 - - [08/Sep/2023:12:57:30 +0000] "GET / HTTP/1.1" 403 146 "-" "Expanse, a Palo Alto Networks company, searches across the global IPv4 space multiple times per day to identify customers' presences on the Internet. If you would like to be excluded from our scans, please send IP addresses/domains to: [email protected]"
167.94.138.124 - - [08/Sep/2023:14:25:14 +0000] "\x16\x03\x01\x00\xEE\x01\x00\x00\xEA\x03\x03\xDAZ\xC0\xA4'\xBEa\xCA\x809\x87\x1Bt@\xB1I\xF1\x0E\x0F\xA3\xF2\xEDn+\xF4\x93w)\xBD\x15\xD6A \xA0BT\xA0\xCFSwgs\xAA\xE7%\x1EW\x9F\x80\x97\xC8\xE5$\xBA\xE5\xE4\xBD\xB9\xC9h\xFBWm7'\x00&\xCC\xA8\xCC\xA9\xC0/\xC00\xC0+\xC0,\xC0\x13\xC0\x09\xC0\x14\xC0" 400 150 "-" "-"
167.94.138.124 - - [08/Sep/2023:14:25:15 +0000] "GET / HTTP/1.1" 403 146 "-" "-"
167.94.138.124 - - [08/Sep/2023:14:25:15 +0000] "GET / HTTP/1.1" 403 146 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)"
167.94.138.124 - - [08/Sep/2023:14:25:16 +0000] "PRI * HTTP/2.0" 400 150 "-" "-"
167.248.133.187 - - [08/Sep/2023:14:51:40 +0000] "GET / HTTP/1.1" 403 146 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)"
167.248.133.187 - - [08/Sep/2023:14:51:41 +0000] "PRI * HTTP/2.0" 400 150 "-" "-"
170.130.204.50 - - [08/Sep/2023:17:01:42 +0000] "GET / HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Linux; Android 11; SM-A515F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Mobile Safari/537.36"
170.130.204.50 - - [08/Sep/2023:17:01:42 +0000] "\x16\x03\x01\x00\xEE\x01\x00\x00\xEA\x03\x03\xADNl\x96U" 400 150 "-" "-"
170.130.204.50 - - [08/Sep/2023:17:01:42 +0000] "\x16\x03\x01\x00\xA0\x01\x00\x00\x9C\x03\x03\x1E@a2\x99+\xB2\xADh<\xDBO\xDB'N\xBE\xEA\x08\x85ld\xBD\xC9\x85\xBC5\x93\x0C\xEF\x19` \x00\x00*\xC0+\xC0/\x00\x9E\xCC\xA9\xCC\xA8\xCC\xAA\xC0" 400 150 "-" "-"
171.67.71.80 - - [08/Sep/2023:17:30:49 +0000] "GET / HTTP/1.1" 403 146 "-" "Mozilla/5.0 zgrab/0.x"
185.156.72.7 - - [08/Sep/2023:20:00:28 +0000] "\x03\x00\x00,'\xE0\x00\x00\x00\x00\x00Cookie: mstshash=Domain" 400 150 "-" "-"
185.156.72.7 - - [08/Sep/2023:20:00:28 +0000] "\x03\x00\x00,'\xE0\x00\x00\x00\x00\x00Cookie: mstshash=Domain" 400 150 "-" "-"
198.235.24.68 - - [08/Sep/2023:20:45:02 +0000] "GET / HTTP/1.1" 403 146 "-" "Expanse, a Palo Alto Networks company, searches across the global IPv4 space multiple times per day to identify customers' presences on the Internet. If you would like to be excluded from our scans, please send IP addresses/domains to: [email protected]"
167.94.145.57 - - [09/Sep/2023:05:07:53 +0000] "\x16\x03\x01\x00\xEE\x01\x00\x00\xEA\x03\x03\xB2\xDC\xE2lN\x82\x89W\xB6\x93(\xCF{qA\x9C?.\xCE\xD3\x06\x9C\x9B\xBB\xDB\x1A\xE3\xA0>\x84=' /\xA3\x8B\xEA\xDB^l\xACU\x9EN\xC5\xAFv,\xE9eIa\xE2\xD6\x80Si\xA3}\xA8X\x09\xE41@\x00&\xCC\xA8\xCC\xA9\xC0/\xC00\xC0+\xC0,\xC0\x13\xC0\x09\xC0\x14\xC0" 400 150 "-" "-"
167.94.145.57 - - [09/Sep/2023:05:07:54 +0000] "GET / HTTP/1.1" 403 146 "-" "-"
167.94.145.57 - - [09/Sep/2023:05:07:54 +0000] "GET / HTTP/1.1" 403 146 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)"
167.94.145.57 - - [09/Sep/2023:05:07:54 +0000] "PRI * HTTP/2.0" 400 150 "-" "-"
171.67.70.84 - - [09/Sep/2023:08:30:36 +0000] "GET / HTTP/1.1" 403 146 "-" "Mozilla/5.0 zgrab/0.x"
167.248.133.35 - - [09/Sep/2023:11:17:37 +0000] "\x16\x03\x01\x00\xEE\x01\x00\x00\xEA\x03\x03\xD6\x03P\x1A)\xC3b\xBF\x0Fo>B\xAE\xFD\xA7p~\xAD`\x1E\xDB\xCA\xB7\x09\x10\xC7]\x1B8\xE0Z\xCA %\xD3\xC8[\x8F\x03\xC6\xCE4\x1E\xB0NP4d1\x92\x92\xF3A\x09\xDE\x0Fy?\xF1V\xAFdZ\x86\x00&\xCC\xA8\xCC\xA9\xC0/\xC00\xC0+\xC0,\xC0\x13\xC0\x09\xC0\x14\xC0" 400 150 "-" "-"
167.248.133.35 - - [09/Sep/2023:11:17:38 +0000] "GET / HTTP/1.1" 403 146 "-" "-"
167.248.133.35 - - [09/Sep/2023:11:17:38 +0000] "GET / HTTP/1.1" 403 146 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)"
167.248.133.35 - - [09/Sep/2023:11:17:38 +0000] "PRI * HTTP/2.0" 400 150 "-" "-"
The flask error logs don't show anything wrong in the code.
So I followed the recommendations found on the web by raising the time in config files:
/www/server/nginx/conf/nginx.conf
user www www;
worker_processes auto;
error_log /www/wwwlogs/nginx_error.log crit;
pid /www/server/nginx/logs/nginx.pid;
worker_rlimit_nofile 51200;
events
{
use epoll;
worker_connections 51200;
multi_accept on;
}
http
{
include mime.types;
#include luawaf.conf;
include proxy.conf;
default_type application/octet-stream;
server_names_hash_bucket_size 512;
client_header_buffer_size 32k;
large_client_header_buffers 4 32k;
client_max_body_size 50m;
sendfile on;
tcp_nopush on;
keepalive_timeout 600;
tcp_nodelay on;
fastcgi_connect_timeout 100000;
fastcgi_send_timeout 100000;
fastcgi_read_timeout 100000;
fastcgi_buffer_size 64k;
fastcgi_buffers 4 64k;
fastcgi_busy_buffers_size 128k;
fastcgi_temp_file_write_size 256k;
fastcgi_intercept_errors on;
gzip on;
gzip_min_length 1k;
gzip_buffers 4 16k;
gzip_http_version 1.1;
gzip_comp_level 2;
gzip_types text/plain application/javascript application/x-javascript text/javascript text/css application/xml;
gzip_vary on;
gzip_proxied expired no-cache no-store private auth;
gzip_disable "MSIE [1-6]\.";
limit_conn_zone $binary_remote_addr zone=perip:10m;
limit_conn_zone $server_name zone=perserver:10m;
server_tokens off;
access_log off;
server
{
listen 888;
server_name phpmyadmin;
index index.html index.htm index.php;
root /www/server/phpmyadmin;
location ~ /tmp/ {
return 403;
}
#error_page 404 /404.html;
include enable-php.conf;
location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
{
expires 30d;
}
location ~ .*\.(js|css)?$
{
expires 12h;
}
location ~ /\.
{
deny all;
}
access_log /www/wwwlogs/access.log;
}
include /www/server/panel/vhost/nginx/*.conf;
}
/www/server/nginx/conf/proxy.conf
proxy_temp_path /www/server/nginx/proxy_temp_dir;
proxy_cache_path /www/server/nginx/proxy_cache_dir levels=1:2 keys_zone=cache_one:20m inactive=1d max_size=5g;
client_body_buffer_size 512k;
proxy_connect_timeout 600;
proxy_read_timeout 600;
proxy_send_timeout 600;
proxy_buffer_size 32k;
proxy_buffers 4 64k;
proxy_busy_buffers_size 128k;
proxy_temp_file_write_size 128k;
proxy_next_upstream error timeout invalid_header http_500 http_503 http_404;
proxy_cache cache_one;
Then I restarted nginx. But I still have this issue.
Where else should I look for? Anyone has a solution please?