Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an Apache2 instance that started receiving hundreds of requests/s for some reason, for all sorts of domains that are not hosted here. There is nothing public running on it.

Here's an excerpt of the access.log: https://gist.github.com/d9edfc546ca77d17b1df

Facts of interest:

  • bind9 was installed on it for a few days, but is not running anymore
  • recently switched to a static IP
  • there is a public subdomain (i.e. xxx.domain.com) pointing to the machine
  • ports 22, 80, and a few others forwarded from the router

iftop shows many active connections to

unn-46-234-119-111.cloudee.eu:64526 
dynamicip-94-181-151-242.pppoe.penza.ertelecom.ru:64219
c-71-228-220-228.hsd1.tn.comcast.net:51688 
89-179-33-252.broadband.corbina.ru:62767
static-98-114-145-42.phlapa.fios.verizon.net:32476

and other variations of these, all to ports that are blocked on the router.

nethog shows PID 0 for those...

0     root     ..1:80-46.234.119.111:64063             0.000       0.000 KB/sec
share|improve this question
    
Could you post the IP? Looks like it is set up as a proxy on numerous hosts for some mysterious reason. –  the-wabbit Dec 14 '11 at 23:38
add comment

1 Answer 1

up vote 2 down vote accepted

From your logs it looks like someone is using your apache server as a proxy and what's troubling is that it looks like you are returning 200 ok to those proxy requests:

46.234.119.111 - - [14/Dec/2011:20:26:53 -0200] "POST http://199.7.177.226/login.php HTTP/1.1" 200 11547

Return value is "200" and you served "11547" bytes. You should check your apache config to make sure you aren't configured as an open proxy.

share|improve this answer
    
Oh god.. the only enabled config has ProxyRequests On followed by a ProxyPass directive. Does that make it an open proxy? –  Ricardo Tomasi Dec 14 '11 at 23:45
    
It's definitely proxying arbitrary requests for me. Turn ProxyRequests OFF! It is only used for forward proxies, not reverse proxy (which is what ProxyPass does) –  Jon Lin Dec 14 '11 at 23:52
    
I disabled mod_proxy, now giving out 500 responses. How long should I expect until requests stop coming in? –  Ricardo Tomasi Dec 15 '11 at 0:00
    
It should be fine if you set ProxyRequests Off. I'm sure eventually they'll stop hammering your server but if it starts to proxy for anyone again, expect to start getting hammered again. –  Jon Lin Dec 15 '11 at 0:04
    
Yeah, it probably started to get visibility when we switched to the fixed IP. Thanks a lot! –  Ricardo Tomasi Dec 15 '11 at 0:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.