Security alerts identified on UXG-Lite and Nginx systems.
Security alerts identified on UXG-Lite and Nginx systems.
I've explored the setup and noticed the Security Detections section in Unraid. The alerts point to traffic from various regions, including the US, Netherlands, and Russia. Since Overseer is using a VPN, the source IPs appear to be masked. To reduce connections to your Nginx Docker container, you might want to check firewall rules, optimize Docker settings, or adjust Unraid's security policies. Let me know if you need further guidance.
when a web server is running on a standard port that's open from your public IP (like 80, 443, and possibly others), it's typical to notice a few crawlers checking those ports daily for every address in the IPv4 range.
You're referring to network or server connections. If you have an internet-hosted server, it's typical for bots to attempt access. Logs often show attempts like phpmyadmin being used even though it isn't installed. Mitigation strategies include tools such as fail2ban that analyze logs and automatically block suspicious IP addresses after repeated failures.
Ports staying open mean bots will constantly try to access them around the clock. I once left SSH on port 22, resulting in hundreds of failed login attempts daily—mostly guessing credentials like admin, root, pi, user, etc. Now I rely solely on RSA keys, but bots still keep trying. Fail2ban helps block them, though.