Blocking RSS Brute Force 1.9

Question

I noticed this weekend that someone was pounding on /rss/catalog/notifystock/ trying to brute force the admin credentials. I've added a line to the nginx vhost.d conf that returns 403 when you attempt to visit /rss/catalog/notifystock/ effectively blocking this attack. I've also blocked /rss/order/new and /rss/catalog/review as I discovered they were vulnerable during my research.

When I check the nginx access log I still see them pounding away. The access log shows it is returning a 301 instead of the 403 they should be seeing. Any ideas on why I might be seeing the 301?

Answer 1

Do you need /rss?

If not, just do this in your nginx server {} block

location ~ ^/index.php/?rss/ {
    deny all;
}
location ~ ^/rss/ {
    deny all;
}