<<On Wed, 15 Jul 2026 15:36:53 -0400, Tom Lane <tgl@sss.pgh.pa.us> said:
> Garrett Wollman <wollman@csail.mit.edu> writes: >> Over the past few months, our mirror server has been the subject of an >> apparent DDoS. Today I tracked it down to millions of attempted >> downloads from `http://postgres.csail.mit.edu/repos/` and I have >> configured the server to return a 403 error for that part of the site; >> we are happy to provide a mirror service for humans to use but we did >> not sign up for 720,000 (and counting) random Linux machines around >> the world to abuse our server and interfere with our own local access >> to the archives.
> That is very strange. What did you have stored there --- was it a > mirror of our source code, or executables, or ???
It is -- or I guess was, I had not realized that the rsync was commented out -- a mirror of rsync.postgresql.org::pgsql-ftp. Now that I've learned that the mirror hasn't been updated in at least a year, I'm going to completely unconfigure it.
That has indeed been discontinued. If you want to mirror the different repos (apt/yum) for internal use you can use the tools from those toolchains to mirror over https. There isn't really any point in keeping a public mirror today, given CDNs.
We're up to 930,000 unique IPs banging on this so far today.
Not bad. As comparison, the main postgres repos get about 1.3-1.6 million unique IPs per day, so you're catching up fast. It certainly sounds like your hostname got listed as an official mirror in some package somewhere, maybe a docker build or something?
Can you see the user-agent being used on the requests? That might give you a hint..
