Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have an apache web server setup in our DMZ that serves most pages, and proxies application requests to a backend server. There is only one place in the config file that has ProxyRequests and it is set to off (ProxyRequests Off).

However, I keep seeing entries like these in our access logs:

[11/Feb/2011:05:13:22 -0500] 92.240.68.153 GET http://ocala.craigslist.org/lab/2204935056.html HTTP/1.1 302 240 "http://ocala.craigslist.org/lab/"
[11/Feb/2011:05:13:32 -0500] 92.240.68.152 GET http://phoenix.craigslist.org/wvl/tag/ HTTP/1.1 302 229 "http://phoenix.craigslist.org/wvl/tag/"
[11/Feb/2011:05:13:42 -0500] 92.240.68.153 GET http://indianapolis.craigslist.org/sec/ HTTP/1.1 302 225 "http://indianapolis.craigslist.org/sec/"
[11/Feb/2011:05:13:52 -0500] 92.240.68.152 GET http://washingtondc.craigslist.org/mld/crs/2206881434.html HTTP/1.1 302 244 "http://washingtondc.craigslist.org/mld/crs/"
[11/Feb/2011:05:14:01 -0500] 92.240.68.153 GET http://chicago.craigslist.org/nch/tix/2206985769.html HTTP/1.1 302 244 "http://chicago.craigslist.org/nch/tix/"
[11/Feb/2011:05:14:11 -0500] 92.240.68.153 GET http://boston.craigslist.org/nos/ofc/ HTTP/1.1 302 229 "http://boston.craigslist.org/nos/ofc/"
[11/Feb/2011:05:14:20 -0500] 92.240.68.153 GET http://boston.craigslist.org/nwb/hum/ HTTP/1.1 302 229 "http://boston.craigslist.org/nwb/hum/"
[11/Feb/2011:05:14:28 -0500] 92.240.68.153 GET http://newyork.craigslist.org/brk/sks/ HTTP/1.1 302 229 "http://newyork.craigslist.org/brk/sks/"
[11/Feb/2011:05:14:38 -0500] 92.240.68.152 GET http://newyork.craigslist.org/mnh/reb/2208492687.html HTTP/1.1 302 244 "http://newyork.craigslist.org/mnh/reb/"
[11/Feb/2011:05:14:47 -0500] 92.240.68.153 GET http://lexington.craigslist.org/fbh/ HTTP/1.1 302 225 "http://lexington.craigslist.org/fbh/"
[11/Feb/2011:05:14:57 -0500] 92.240.68.153 GET http://greenville.craigslist.org/pts/ HTTP/1.1 302 225 "http://greenville.craigslist.org/pts/"
[11/Feb/2011:05:15:07 -0500] 92.240.68.152 GET http://denver.craigslist.org/thp/ HTTP/1.1 302 225 "http://denver.craigslist.org/thp/"

This concerns me because we usually get these, but I can normally find a correlating entry in the error log stating that the file couldn't be found under the default virtual host.

How could I definitively verify that these proxy requests are truly not being carried out?

share|improve this question
    
The server is returning 302 HTTP error code (redirect). Is this OK with you? – Khaled Feb 11 '11 at 13:47
    
I would rather a 403 be returned if it's a proxy request. I don't know if that's normal convention, or if there is some other convention used. – Matt Feb 11 '11 at 15:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.