{"thread":{"id":"48216","subject":"Socket activation for GitWeb FastCGI with systemd?","startedAt":"2018-04-03T19:00:35Z","lastAt":"2018-04-04T16:43:21Z","messageCount":3,"participants":["Alex Ivanov","Jacob Keller"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"343753","messageId":"671541522781590@web3o.yandex.ru","threadId":"48216","inReplyTo":null,"subject":"Socket activation for GitWeb FastCGI with systemd?","fromName":"Alex Ivanov","fromEmail":"gnidorah@ya.ru","sentAt":"2018-04-03T18:53:10Z","receivedAt":"2018-04-03T19:00:35Z","isPatch":false,"sender":{"key":"gnidorah@ya.ru","avatar":null},"body":"Hi.\nI want to use systemd as fastcgi spawner for gitweb + nginx. \nThe traffic is low and number of users is limited + traversal bots. For that reason I've decided to use following mimimal services\n\ngitweb.socket\n[Unit]\nDescription=GitWeb Socket\n\n[Socket]\nListenStream=/run/gitweb.sock\nAccept=false\n\n[Install]\nWantedBy=sockets.target\n\ngitweb.service\n[Unit]\nDescription=GitWeb Service\n\n[Service]\nType=simple\nExecStart=/path/to/gitweb.cgi --fcgi\nStandardInput=socket\n\nHowever this scheme is not resistant to simple DDOS.\nE.g. traversal bots often kill the service by opening non existing path (e.g http://host/?p=repo;a=blob;f=nonexisting/path;hb=HEAD showing in browser 404 - Cannot find file) many times consecutively, which leads to\nApr 03 21:32:10 host systemd[1]: gitweb.service: Start request repeated too quickly.\nApr 03 21:32:10 host systemd[1]: gitweb.service: Failed with result 'start-limit-hit'.\nApr 03 21:32:10 host systemd[1]: Failed to start GitWeb service.\nand 502 Bad Gateway in browser. I believe the reason is that gitweb.service dies on failure and if it happens too often, systemd declines to restart the service due to start limit hit.\nSo my question is how to correct systemd services for GitWeb to be resistant to such issue? I prefer to use single process to process all clients.\nThanks.\n"},{"id":"343763","messageId":"CA+P7+xoaOt4KwTOQSfwiyB1CQ317kbCZ2u26RoPA02Z4WYr9EA@mail.gmail.com","threadId":"48216","inReplyTo":"671541522781590@web3o.yandex.ru","subject":"Re: Socket activation for GitWeb FastCGI with systemd?","fromName":"Jacob Keller","fromEmail":"jacob.keller@gmail.com","sentAt":"2018-04-03T20:04:35Z","receivedAt":"2018-04-03T20:05:01Z","isPatch":false,"sender":{"key":"jacob.keller@gmail.com","avatar":"https://avatars.githubusercontent.com/u/874719?v=4"},"body":"On Tue, Apr 3, 2018 at 11:53 AM, Alex Ivanov <gnidorah@ya.ru> wrote:\n> Hi.\n> I want to use systemd as fastcgi spawner for gitweb + nginx.\n> The traffic is low and number of users is limited + traversal bots. For that reason I've decided to use following mimimal services\n>\n> gitweb.socket\n> [Unit]\n> Description=GitWeb Socket\n>\n> [Socket]\n> ListenStream=/run/gitweb.sock\n> Accept=false\n>\n> [Install]\n> WantedBy=sockets.target\n>\n> gitweb.service\n> [Unit]\n> Description=GitWeb Service\n>\n> [Service]\n> Type=simple\n> ExecStart=/path/to/gitweb.cgi --fcgi\n> StandardInput=socket\n>\n> However this scheme is not resistant to simple DDOS.\n> E.g. traversal bots often kill the service by opening non existing path (e.g http://host/?p=repo;a=blob;f=nonexisting/path;hb=HEAD showing in browser 404 - Cannot find file) many times consecutively, which leads to\n> Apr 03 21:32:10 host systemd[1]: gitweb.service: Start request repeated too quickly.\n> Apr 03 21:32:10 host systemd[1]: gitweb.service: Failed with result 'start-limit-hit'.\n> Apr 03 21:32:10 host systemd[1]: Failed to start GitWeb service.\n> and 502 Bad Gateway in browser. I believe the reason is that gitweb.service dies on failure and if it happens too often, systemd declines to restart the service due to start limit hit.\n> So my question is how to correct systemd services for GitWeb to be resistant to such issue? I prefer to use single process to process all clients.\n> Thanks.\n\nThis sounds like a systemd specific question that might get a better\nanswer from the systemd mailing list.\n\nThat being said, I believe if in this case gitweb is dying due to the\npath not existing? You might be able to configure systemd to\nunderstand that the particular exit code for when the path doesn't\nexist is a \"valid\" exit, and not a failure case..\n\nI'm not entirely understanding your goal.. you want each request to\nlaunch the gitweb process, and when it's done you want it to exit? But\nif there are multiple connections at once you want it to stay alive\nuntil it services them all? I think the best answer is configure\nsystemd to understand that the exit code for when the path is invalid\nwill be counted as a success.\n\nThanks,\nJake\n"},{"id":"343791","messageId":"2030761522859768@web13j.yandex.ru","threadId":"48216","inReplyTo":"CA+P7+xoaOt4KwTOQSfwiyB1CQ317kbCZ2u26RoPA02Z4WYr9EA@mail.gmail.com","subject":"Re: Socket activation for GitWeb FastCGI with systemd?","fromName":"Alex Ivanov","fromEmail":"gnidorah@ya.ru","sentAt":"2018-04-04T16:36:08Z","receivedAt":"2018-04-04T16:43:21Z","isPatch":false,"sender":{"key":"gnidorah@ya.ru","avatar":null},"body":"\n\n03.04.2018, 23:04, \"Jacob Keller\" <jacob.keller@gmail.com>:\n> On Tue, Apr 3, 2018 at 11:53 AM, Alex Ivanov <gnidorah@ya.ru> wrote:\n>>  Hi.\n>>  I want to use systemd as fastcgi spawner for gitweb + nginx.\n>>  The traffic is low and number of users is limited + traversal bots. For that reason I've decided to use following mimimal services\n>>\n>>  gitweb.socket\n>>  [Unit]\n>>  Description=GitWeb Socket\n>>\n>>  [Socket]\n>>  ListenStream=/run/gitweb.sock\n>>  Accept=false\n>>\n>>  [Install]\n>>  WantedBy=sockets.target\n>>\n>>  gitweb.service\n>>  [Unit]\n>>  Description=GitWeb Service\n>>\n>>  [Service]\n>>  Type=simple\n>>  ExecStart=/path/to/gitweb.cgi --fcgi\n>>  StandardInput=socket\n>>\n>>  However this scheme is not resistant to simple DDOS.\n>>  E.g. traversal bots often kill the service by opening non existing path (e.g http://host/?p=repo;a=blob;f=nonexisting/path;hb=HEAD showing in browser 404 - Cannot find file) many times consecutively, which leads to\n>>  Apr 03 21:32:10 host systemd[1]: gitweb.service: Start request repeated too quickly.\n>>  Apr 03 21:32:10 host systemd[1]: gitweb.service: Failed with result 'start-limit-hit'.\n>>  Apr 03 21:32:10 host systemd[1]: Failed to start GitWeb service.\n>>  and 502 Bad Gateway in browser. I believe the reason is that gitweb.service dies on failure and if it happens too often, systemd declines to restart the service due to start limit hit.\n>>  So my question is how to correct systemd services for GitWeb to be resistant to such issue? I prefer to use single process to process all clients.\n>>  Thanks.\n>\n> This sounds like a systemd specific question that might get a better\n> answer from the systemd mailing list.\n\nThanks I will try that too.\n\n>\n> That being said, I believe if in this case gitweb is dying due to the\n> path not existing? You might be able to configure systemd to\n> understand that the particular exit code for when the path doesn't\n> exist is a \"valid\" exit, and not a failure case..\n\nI will try to do that, but I'm afraid that there may be other ways to remotely abuse the service.\n\n>\n> I'm not entirely understanding your goal.. you want each request to\n> launch the gitweb process, and when it's done you want it to exit? But\n> if there are multiple connections at once you want it to stay alive\n> until it services them all? I think the best answer is configure\n> systemd to understand that the exit code for when the path is invalid\n> will be counted as a success.\n\nI want a single process for all connections too keep RAM usage at minimal. I also though it fits my case since number of users is low.\n\n>\n> Thanks,\n> Jake\n"}]}