-
|
Hello community, We've noticed a large amount of external domains attempting to provision acme certificates in our proxies. These are domains that are not in the This is an example taken from the logs:
This is particularly concerning for us (at least from the verbiage of the logged errors), because it looks like an external - unauthorized - client can get as far as attempting to provision certificates using our proxy. Can anyone tell how or why is this happening? Should it be considered harmless spam? |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 3 replies
-
|
Teleport will attempt to get certs for web applications enrolled in the cluster. Is it possible that you have enrolled apps with these public addresses? |
Beta Was this translation helpful? Give feedback.
-
|
100% not, that's what is concerning me. This looks like someone externally trying to register resources using my proxies, but how would they get as far as that without valid tokens? |
Beta Was this translation helpful? Give feedback.
-
|
The version of Teleport we use in our proxy is 16.5.12. We don't have a cluster, it's a single proxy+auth deployment on the same machine, for a very small amount of nodes/web apps we use internally, running on always up to date Debian 12, firewall only opens port 443. I can confirm that there are no registered resources that we cannot recognize ourselves. The frequency and variety of these log entries is very high, this is what just came through in 1 hour:
|
Beta Was this translation helpful? Give feedback.
-
|
Gotcha. Then this is most likely someone on the internet poking at your deployment. A common DoS attack is to make a bunch of connections to a server supporting ACME, but asking for an incorrect host name. This forces the server into attempting to obtain certs for these domains, which fails but will eventually result in your server getting rate limited and becoming unable to get/renew real certs when the time comes. You don't need to take any action, the warnings you see in the logs are happening because Teleport is refusing to attempt to get certs for these bogus domains. |
Beta Was this translation helpful? Give feedback.
Gotcha. Then this is most likely someone on the internet poking at your deployment.
A common DoS attack is to make a bunch of connections to a server supporting ACME, but asking for an incorrect host name. This forces the server into attempting to obtain certs for these domains, which fails but will eventually result in your server getting rate limited and becoming unable to get/renew real certs when the time comes.
You don't need to take any action, the warnings you see in the logs are happening because Teleport is refusing to attempt to get certs for these bogus domains.