3

I have some apache server on ubuntu and fore some times there a lot of requirest in /var/log/apache2/access.log like this:

115.231.218.252 - - [04/Dec/2017:08:35:38 -0500] "CONNECT www.alipay.com:443 HTTP/1.1" 403 451 "-" "Go 1.1 package http"
118.123.12.179 - - [04/Dec/2017:08:36:08 -0500] "GET http://www.search.com/?rnd=_72367536011469122613864 HTTP/1.1" 403 450 "-" "-"

There was a lot of such requests and I filtered them via whitelisting IP addresses, which may access my server, but I don't like this solution

Correct requrest for my service looks like this:

95.79.59.202 - - [04/Dec/2017:08:34:43 -0500] "GET /js/comments.js?1461239263 HTTP/1.1" 200 2563 "data" "Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0"

Correct requests never starts with http
modproxy is disabled, and I dont' need to have proxy on this site in any form Is there any way to disable all request of http resource, not just local?

Loaded modules are:

 core_module (static)
 so_module (static)
 watchdog_module (static)
 http_module (static)
 log_config_module (static)
 logio_module (static)
 version_module (static)
 unixd_module (static)
 access_compat_module (shared)
 alias_module (shared)
 auth_basic_module (shared)
 authn_core_module (shared)
 authn_file_module (shared)
 authz_core_module (shared)
 authz_host_module (shared)
 authz_user_module (shared)
 autoindex_module (shared)
 cgid_module (shared)
 deflate_module (shared)
 dir_module (shared)
 env_module (shared)
 expires_module (shared)
 filter_module (shared)
 headers_module (shared)
 mime_module (shared)
 mpm_event_module (shared)
 negotiation_module (shared)
 perl_module (shared)
 rewrite_module (shared)
 security2_module (shared)
 setenvif_module (shared)
 status_module (shared)
 unique_id_module (shared)
5
  • What is the problem here exactly? Client requests will be logged as they were sent, and even if you don't allow proxying in the server if someone tries to use your server as a proxy you will see it in the logs anyways, that does not mean it is having any effect, in fact they are getting a "forbidden". – ezra-s Dec 4 '17 at 13:48
  • They forbidden only if I enable whitelisting, but if I allow all - someone used my server like proxy for botnet to access shady sites, and give me 100% CPU during that :) – ShockwaveNN Dec 4 '17 at 14:07
  • for that to happen you need, mod_proxy, mod_proxy_http, mod_proxy_connect (for SSL) and ProxyRequests on, otherwise it can't happen. – ezra-s Dec 4 '17 at 14:10
  • ok, maybe problem not in proxy, but as soon I disable ip white list I have 100% cpu and a lot of entries in access.log. And if I disable whitelist - 403 status for malicious requests change to 200 – ShockwaveNN Dec 4 '17 at 14:12
  • Review your config, perhaps you have a index.html or similar that you are serving to all non-existant requests. At least try to do the same and examine the response. – ezra-s Dec 5 '17 at 9:20
0

You can conditionally block requests using mod rewrite.

For example the following will block GET and POST requests where the requested URI starts with http:// or https://

RewriteEngine On
RewriteCond %{THE_REQUEST} "^(GET|POST) https?://"
RewriteRule ^ - [F]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.