Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

I'm on Debian Lenny using apache2. in my proxy.conf I tried adding 

Allow from localhost

as suggested in some other forums to get proxying to work. Didn't work. It only worked if I say 

Allow from all

My question is this. Are there any security implications to this Allow from all directive? Most people were saying to make this as limited as possible, but "all" is the client right? I want anyone regardless of their IP to be forwarded properly. Is there a better way to configure this?

share|improve this question

2 Answers

up vote 0 down vote

I think I'd need to know a bit more about your configuration. "ProxyRequests" is the critical directive. it determines if your server will act as an HTTP proxy. if so, this is a serious security risk because anyone can connect to the web through your server. I'm sure people are scanning for this kind of hole regularly.

however, if your ALLOW rule is in a "Directory" or "Location" directive, it's probably less of an issue, as long as you want that directory to be accessible by the internet.

share|improve this answer
Here's what's in my proxy.conf: ProxyRequests Off <Proxy *> AddDefaultCharset off Order deny,allow Allow from all </Proxy> And in my vhost: ProxyPreserveHost On ProxyPass / localhost:8080/some_url – brad Oct 17 '09 at 17:19
damn, formatting doens't work in comments, but i think you get the gist of it? I'm assuming this is pretty safe then as ProxyRequests is off? – brad Oct 17 '09 at 17:20
I mean, its about as safe as putting anything on the internet. some people seem to forget that if it's accessible from the web server, the WHOLE WORLD can potentially access it. if this isnt the goal, you might want to consider restricting access to local addresses and IPs of people you trust. since it's a webserver, I assume the default preference is to be web accessible though. – neoice Oct 18 '09 at 4:38
i'm just looking for something that might create a hole in my server, of course anyone can access the site, I would just like to make sure there aren't any open security issues that wouldn't otherwise be there if mod_proxy wasn't being used – brad Oct 20 '09 at 22:14
up vote 0 down vote

So the answer is allowing proxy at the top from the whole world puts you back to apache1.3 level of security, which is fine if you're careful about using mod_proxy.

Here's how I do proxy's in apache2.2 to retain the careful restrictions, in this case a proxy to my APT cache:

<VirtualHost *:80>
        Servername apt.lan

        ProxyPass               / http://127.0.0.1:1723/
        ProxyPassReverse        / http://127.0.0.1:1723/

        <Proxy http://127.0.0.1:1723/>
                Order allow,deny
                Deny from none
                Allow from all
        </Proxy>
</VirtualHost>

Obviously only the "Proxy" lines and block are relevant to the question, but I thought I should include a full example.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.