0

I recently noticed the following messages in Apache's access log:

"GET http://api.ipify.org/ HTTP/1.1" 200 251
"GET http://boxun.com/ HTTP/1.1" 200 251
"GET http://www.epochtimes.com/ HTTP/1.1" 200 251
"GET http://www.123cha.com/ HTTP/1.1" 200 251

These requests look innocuous enough, but it's concerning to me that Apache responded with a 200. Does this mean that it's happily acting as a proxy server for requests to other domains? Am I right in being concerned by this, and is there a setting I can configure to prevent it from doing so?

Also, how do these requests even reach my server? Is there a way to craft a cURL command to issue a GET request for a particular URL to an unrelated domain?

Here's the result of apachectl -S with my domain replaced with example.com:

VirtualHost configuration:
*:443                  is a NameVirtualHost
         default server example.com (/etc/httpd/conf/extra/httpd-ssl.conf:121)
         port 443 namevhost example.com (/etc/httpd/conf/extra/httpd-ssl.conf:121)
                 wild alias *.example.com
         port 443 namevhost sample.example.com (/etc/httpd/conf/extra/httpd-vhosts.conf:72)
                 alias www.sample.example.com
                 alias example.com/sample
         port 443 namevhost test.example.com (/etc/httpd/conf/extra/httpd-vhosts.conf:101)
                 alias example.com/test
         port 443 namevhost comp.example.com (/etc/httpd/conf/extra/httpd-vhosts.conf:113)
                 alias example.com/comp
         port 443 namevhost less.example.com (/etc/httpd/conf/extra/httpd-vhosts.conf:125)
         port 443 namevhost nothing.example.com (/etc/httpd/conf/extra/nothing.conf:13)
*:80                   is a NameVirtualHost
         default server example.com (/etc/httpd/conf/extra/httpd-vhosts.conf:66)
         port 80 namevhost example.com (/etc/httpd/conf/extra/httpd-vhosts.conf:66)
         port 80 namevhost sample.example.com (/etc/httpd/conf/extra/httpd-vhosts.conf:72)
                 alias www.sample.example.com
                 alias example.com/sample
         port 80 namevhost test.example.com (/etc/httpd/conf/extra/httpd-vhosts.conf:101)
                 alias example.com/test
         port 80 namevhost comp.example.com (/etc/httpd/conf/extra/httpd-vhosts.conf:113)
                 alias example.com/comp
         port 80 namevhost less.example.com (/etc/httpd/conf/extra/httpd-vhosts.conf:125)
         port 80 namevhost nothing.example.com (/etc/httpd/conf/extra/nothing.conf:13)
ServerRoot: "/etc/httpd"
Main DocumentRoot: "/srv/http"
Main ErrorLog: "/var/log/httpd/error_log"
Mutex proxy-balancer-shm: using_defaults
Mutex ssl-stapling-refresh: using_defaults
Mutex rewrite-map: using_defaults
Mutex ssl-stapling: using_defaults
Mutex proxy: using_defaults
Mutex ssl-cache: using_defaults
Mutex default: dir="/run/httpd/" mechanism=default 
PidFile: "/run/httpd/httpd.pid"
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
User: name="http" id=33
Group: name="http" id=33

Here's the result of sending such a request with curl:

$ curl -vs -o /dev/null -H 'Host: api.ipify.org' http://example.com/
*   Trying 93.184.216.34...
* TCP_NODELAY set
* Connected to example.com (93.184.216.34) port 80 (#0)
> GET / HTTP/1.1
> Host: api.ipify.org
> User-Agent: curl/7.61.1
> Accept: */*
> 
< HTTP/1.1 200 OK
< Date: Fri, 19 Oct 2018 20:28:12 GMT
< Server: Apache/2.4.35 (Unix) OpenSSL/1.1.1
< Upgrade: h2
< Connection: Upgrade
< Last-Modified: Tue, 03 Jul 2018 14:20:39 GMT
< ETag: "fb-5701904b6ba1c"
< Accept-Ranges: bytes
< Content-Length: 251
< Content-Type: text/html
< 
{ [251 bytes data]
* Connection #0 to host example.com left intact

$ tail -n 1 /var/log/httpd/access_log
"GET / HTTP/1.1" 200 251
5
  • 2
    It might be that your apache configuration has a "catchall" virtual host (i.e. ServerAlias * or similar). Can you edit your question and post your apache virtual host configuration?
    – Mr Shunz
    Oct 19 '18 at 15:27
  • Not likely, with a 251 byte response for every single one of them. Try it yourself and see what comes back. Oct 19 '18 at 16:10
  • How do I try it myself? I can use curl to send a GET request, but if I issue it to http://api.ipify.org/ it won't go to my server, and if I issue it to my server it will start with /.
    – Altay_H
    Oct 19 '18 at 16:18
  • 1
    curl -vs -o /dev/null -H 'Host: api.ipify.org' http://your.server.address/
    – guzzijason
    Oct 19 '18 at 20:26
  • That does return a 251-byte HTTP 200 response, but oddly it shows up in the access logs at a GET request for /.
    – Altay_H
    Oct 19 '18 at 20:41
0

Your server does not decide with which domain a client contacts it, that's the DNS server prerogative.

You surely have a "catch-all" virtualhost, according to Apache manual, the first virtualhost loaded is the one that will answer to all requests that do not match any other virtualhost requirements.

A way you can try this, is simply by having an entry in your hosts file (/etc/hosts for linux clients, c:\Windows\System32\drivers\etc\hosts for windows clients) that binds your server IP with any domain, example.com being a nice example.

Now if you try to open http://example.com, you'll see the DirectoryIndex for your server's first configured virtualhost, and you'll have a nice row in your log stating that someone (you) requested http://example.com from your server, and it got a 200 OK as response.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.