Strange Apache LOGs...

TheIrish · 02-10-2004, 11:56 AM

Hi all,
many of you might already have seen a log like this:

Code:

80.***.4.56 - - [01/Jan/2004:07:22:01 +0100] "connect 195.***.76.123:25 HTTP/1.0" 200 14402 "-"

I believe I know what's the meaning of all this. Unluckly, all the answers I found over the net sound like 'disable mod_proxy'. Well, it was disabled since my very first installation of apache...
Now, assuming I have an efficient firewall script, only ports 80,25 open, and mod_proxy disabled... what else could it be? Is that 200 reliable enough?
Thanks

jazernorth · 02-10-2004, 12:02 PM

Depends on how your Apache is configured.

Check:
NameVirtualHost
It should be set to *:80, which would force Apache to listen on all IP's and only port 80. If it is * then Apache will listen to all IP's and all ports. Therefore, if someone requests on :25, Apache will probably respond.

JN

Capt_Caveman · 02-10-2004, 12:08 PM

Probably spammers looking for open proxies. By default, apache won't allow proxy connections like that attempt. What's going on is Apache will return the default homepage of your site when someone attempts to make a proxy connection through to somewhere else. So it does return a "200" (success), but they get back your homepage instead.

TheIrish · 02-10-2004, 01:15 PM

Thanks for the advices!