Webserver error / connection attempt from outside IP?

[skribb]

Hi, I just started using the webserver and so far I have seen two errors in my log, that look like this;

23:44:47 Exception happened during processing of request from ('::ffff:91.230.25.116', 53622, 0, 0)
23:44:47 Traceback (most recent call last):
23:44:47 File "SocketServer.pyc", line 558, in process_request_thread
23:44:47 File "SocketServer.pyc", line 320, in finish_request
23:44:47 File "SocketServer.pyc", line 615, in __init__
23:44:47 File "BaseHTTPServer.pyc", line 329, in handle
23:44:47 File "C:\Program Files (x86)\EventGhost\plugins\Webserver\__init__.py", line 974, in handle_one_request
23:44:47 SimpleHTTPRequestHandler.handle_one_request(self)
23:44:47 File "BaseHTTPServer.pyc", line 312, in handle_one_request
23:44:47 File "socket.pyc", line 406, in readline
23:44:47 error: [Errno 10054] An existing connection was forcibly closed by the remote host
23:44:47 ----------------------------------------

Now, the IP adress is apparently from Ukraine (i'm not) and I was wondering, does the above mean that this Ukraine computer has been trying to connect to my EG webserver? I have it running on port 8434 and using password, but no HTTPS. I only send commands to EG webserver via Tasker on my phone, using my copmuter's LAN IP, via wifi.

[wakko]

I suppose, your machine with EventGhost is using, so called, "real" IP address, accessible from outside network (internet).
It is extremely insecure, because no one can guarantee, that your software, EG's web server in that case, absolutely error-free. Such errors can be used by a hackers to gain remote control over your machine. And then make a spam bot from it, or a "next hop" for a network attacks. Anything.

First rule for a system administrator, is to disable all unneeded services, and for those, that are needed, close any possible connection ways from external networks, such as internet.

What you have seen, is a work of a "usual" network scan tool.
May be it was so called "script kiddie" (wannabe hacker with just downloaded hack tools).
Is also may be computer-zombie, part of some botnet, gathering info of subnetworks for his owner. Etc.

If you using network filter then just close possibility for all connection attempts from outside network, except IP address of your smartphone. Of course, your smartphone should have fixed "real" IP address.

[skribb]

Thanks for the informative reply.

Yeah, that's what I thought.

How would I make EG automatically block connection attempts from non-LAN IP's? I did find out tho that I might be able to use a UDP sender plugin that hopefully will be more secure than the webserver plugin.

[wakko]

AFAIK, EG do not have such feature.

Instead, if you using LAN router with network filter function, you can adjust and enable it.
Or, you can install on machine with EG some free or non free network filtering software.
And third way, will be acceptable for you only, if machine with EG do not need internet at all, with excepting your smartphone's "real" IP.

Just delete "default route" from network connection properties on machine with EG.
By using console (cmd.exe) with admin rights, add a route only to those external IP addresses, which you need.

example:
route -p add <IP address of your smartphone> <IP address of gateway of your ISP>
Now your EG machine will be reachable from outside network only for your smartphone.

[skribb]

Having a dedicated machine for EG with no internet connection sounds pretty appealing, I'll look into that