6

In the log file of apache (access.log) I find log entries like the following:

10.20.30.40 - - [18/Mar/2011:02:12:44 +0200] 
"GET /index.php HTTP/1.1" 404 505 "-" "Opera/9.80 (Windows NT 6.1; U; en) 
Presto/2.7.62 Version/11.01"

Whose meaning is clear: The client with IP 10.20.30.40 applied a GET HTTP method on /index.php (that is to say http://mysite.org/index.php) receiving a status code 404 using Opera as client/browser. What I don't understand is entries like the following:

174.34.231.19 - - [18/Mar/2011:02:24:56 +0200] 
"GET http://www.siasatema.com HTTP/1.1" 200 469 "-" 
"Python-urllib/2.4"

So here what I see is that someone (client with IP 174.34.231.19) accessed http://www.siasatema.com and got a 200 HTTP status code(?). It doesn't make sense to me... the only interpretation I can think of is that my apache server acts like proxy! Here are some other requests that don't have my site as destination...

187.35.50.61 - - [18/Mar/2011:01:28:20 +0200] "POST http://72.26.198.222:80/log/normal/ HTTP/1.0" 404 491 "-" "Octoshape-sua/1010120"
87.117.203.177 - - [18/Mar/2011:01:29:59 +0200] "CONNECT 64.12.244.203:80 HTTP/1.0" 405 556 "-" "-"
87.117.203.177 - - [18/Mar/2011:01:29:59 +0200] "open 64.12.244.203 80" 400 506 "-" "-"
87.117.203.177 - - [18/Mar/2011:01:30:04 +0200] "telnet 64.12.244.203 80" 400 506 "-" "-"
87.117.203.177 - - [18/Mar/2011:01:30:09 +0200] "64.12.244.203 80" 400 301 "-" "-"

I believe that all these are related to some kind of attack or abuse of the server. Could someone explain to may what is going on and how to cope with this situation?

Update 1:

I disabled mod_proxy to make sure that I don't have an open proxy:

# a2dismod proxy

Where from I got the message:

Module proxy already disabled

I made sure that there is no file proxy.conf under $APACHE/mods-enabled. Finally, I set on my browser (Mozzila) my IP as a proxy and tried to access http://google.com. I was not redirected to google.com but instead my web page appeared. The same happened with trying to access http://a.b (!). So my server does not really work as a proxy since it does not forward the requests... But I think it would be better if somehow I could configure it to return a status code 403.

Here is my apache configuration file:

<VirtualHost *:80>
    ServerName mysite.org
    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/  
    <Directory />
        Options FollowSymLinks
        AllowOverride None
    </Directory>
    <Directory /var/www/>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride None
        Order allow,deny
        allow from all
    </Directory>

    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    <Directory "/usr/lib/cgi-bin">
        AllowOverride None
        Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
        Order allow,deny
        Allow from all
    </Directory>

    ErrorLog /var/log/apache2/error.log    
    LogLevel warn    
    CustomLog /var/log/apache2/access.log combined

    Alias /doc/ "/usr/share/doc/"
    <Directory "/usr/share/doc/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        Order deny,allow
        Deny from all
        Allow from 127.0.0.0/255.0.0.0 ::1/128
    </Directory>
</VirtualHost>

Update 2:

Using a block, I restrict the use of other methods than GET and POST...

<Limit POST PUT CONNECT HEAD OPTIONS DELETE 
  PATCH PROPFIND PROPPATCH MKCOL COPY MOVE LOCK UNLOCK>
  Order deny,allow
  Deny from all
</Limit>
<LimitExcept GET>
  Order deny,allow
  Deny from all
</LimitExcept>

Now methods other that GET are forbidden (403). My only question now is whether there is some trick to boot those how try to use my server as a proxy out...

2
  • It's hard for me to tell what's going on here. The telnet is a little odd unless you are testing with telnet. My gut tells me this could be an attack/scan of some sort but there isn't enough information for me to understand what's going on.
    – egorgry
    Mar 18, 2011 at 12:35
  • Oh, you don't neet both the Limit and LimitExcept blocks. Just leave the LimitExcept there, and it'll do the same thing.
    – Decado
    Mar 21, 2011 at 10:03

4 Answers 4

6

Okay, well i can get that exact log message using the following python code

import urllib
proxies = {'http':'http://myapacheserevr'}
file_handle = urllib.urlopen('http://www.siasatema.com',proxies=proxies)

Which gives me the log entry

192.168.0.28 - - [18/Mar/2011:14:40:40 +0200] "GET http://www.siasatema.com HTTP/1.0" 200 453 "-" "Python-urllib/1.17"

Incidently all i get back from this is the contents of my default web page,

So, yes something is proxying through your webserver it's probably hackers looking for open, badly configured, proxies to connect to and abuse another site. To stop it set:-

ProxyRequests Off 

Incidently i can replicate the other one's by doing

$ nc ubuntuvm 80
telnet 64.12.244.203 80

Which gives:- 192.168.0.28 - - [18/Mar/2011:14:58:47 +0200] "telnet 64.12.244.203 80" 400 505 "-" "-"

6
  • I verified what you say but when using my server as a proxy you are not actually redirected, nor blocked. You get a status code 200 and my web page in the response body (!). See Update 1 above. Any ideas on how to secure the proxy? What is more, according to both atomintersoft.com/proxy_checker and checker.freeproxy.ru/checker/index.php, my server is not a proxy. Mar 18, 2011 at 13:54
  • Sorry, i meant to say they are trying to use your website as a proxy, not that they were neccesarily succeeding. You can add <LimitExcept> blocks to the directories to only allow certain methods to certain people.
    – Decado
    Mar 18, 2011 at 14:08
  • Hm... I think you're right! However <LimitExcept> will only restrict access using certain method (and I can't ban GET or POST!). Maybe iptables can be used to restrict such kind of access on port 80 when the destination IP is not mine? Mar 18, 2011 at 14:33
  • I think you'll find the destination is yours, it's the content of the request that's funny, so i don't think iptables will help. To be honest if it's not actually proxying it i don't think it's an issue. They wont be achieving much, other than bandwidth use.
    – Decado
    Mar 18, 2011 at 14:44
  • Yes, correct! Anyway they could be accessing the web page directly. Is there some way to return a 403 in such cases? Mar 18, 2011 at 14:49
4

Your server is a open proxy which is a security problem. Spammers can send mails through your server. Others can look at child pr0n from your server. Fix it asap.

Change

ProxyRequests Off

,in proxy configuration, to fix it.

2

I do not think that your apache is an open proxy.

174.34.231.19 - - [18/Mar/2011:02:24:56 +0200] "GET http://www.siasatema.com HTTP/1.1" 200 469 "-" "Python-urllib/2.4"

Could be someone that is sending a HTTP request to your apache server using www.siasatema.com as hostname in the request. The apache server will serve in this case the default page (the first virtual host). You can configure apache to discard this kind of requests or to redirect to your main page.

187.35.50.61 - - [18/Mar/2011:01:28:20 +0200] "POST http://72.26.198.222:80/log/normal/ HTTP/1.0" 404 491 "-" "Octoshape-sua/1010120"
87.117.203.177 - - [18/Mar/2011:01:29:59 +0200] "CONNECT 64.12.244.203:80 HTTP/1.0" 405 556 "-" "-"
87.117.203.177 - - [18/Mar/2011:01:29:59 +0200] "open 64.12.244.203 80" 400 506 "-" "-"
87.117.203.177 - - [18/Mar/2011:01:30:04 +0200] "telnet 64.12.244.203 80" 400 506 "-" "-"
87.117.203.177 - - [18/Mar/2011:01:30:09 +0200] "64.12.244.203 80" 400 301 "-" "-"

Those are unsuccessful requests that apache has discarded.

1

I believe the case is very simple: someone comes to your server, with correct IP but not with the name you expect, and gets the front page. This can be generated for example with the following:

A broadband user adds to his hosts file (/etc/hosts, or /windows/system32/drivers/etc/hosts) the entry

aa.bb.cc.dd rubbishrubbishrubbish.com

where aa.bb.cc.dd is your IP address, and after that uses any browser to access http://rubbishrubbishrubbish.com

You will see in the log file the access, and the "GET" for the / of rubbishrubbishrubbish.com. Typical apache installations are not interested in the hostname part of the URL, but just in the rest of it, thus returning your homepage.

Note also that your server can of course be accessed by using it's IP address or FQDN, or possible nicknames, which (unless forced explicitly) do not need to be known to the apache server. My home web server can be reached with multiple names over ipv4 and ipv6, but my server itself does not know any of those domain names.

The remaining question is: why? I guess the answer is: to test if you act as proxy. And you do not. And Python-urllib/2.4 has also been reported to be a BOT (but not always).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .