Disabling Apache mod_proxy Features

romeo_tango · 03-31-2011, 04:52 AM

Hi,

I'm using CentOS 5 and just found out that there are people using my Apache Web Server as proxy (version 2.2.3 the OS's default).

I've checked out that my mod_proxy is already disabled but the unauthorized incoming request is still very large.

So I tried to compile an Apache from raw (2.2.17) just enabling mod_rewrite and then found out that the 'proxy' request is still there.

Tried httpd -l and here are the modules inside the Apache :

Code:

# /opt/apachew/bin/httpd -l
Compiled in modules:
  core.c
  mod_authn_file.c
  mod_authn_default.c
  mod_authz_host.c
  mod_authz_groupfile.c
  mod_authz_user.c
  mod_authz_default.c
  mod_auth_basic.c
  mod_include.c
  mod_filter.c
  mod_log_config.c
  mod_env.c
  mod_setenvif.c
  mod_version.c
  prefork.c
  http_core.c
  mod_mime.c
  mod_status.c
  mod_autoindex.c
  mod_asis.c
  mod_cgi.c
  mod_negotiation.c
  mod_dir.c
  mod_actions.c
  mod_userdir.c
  mod_alias.c
  mod_rewrite.c
  mod_so.c

There should be no mod_proxy but why should it still accepting proxy request? I checked the access_log file and still found "http://www.google.com" and so on.

My question is :
- How to block all the proxy request and only accepting the normal web server request? I also have tried to enable proxy in the previous Apache and then setting up "ProxyRequest Off" and Proxy * only from localhost but the request is still there.

I tried by myself using the webserver as proxy in browser and all the URLs I opened including the false URL will be redirected to my index.php and this should show me that 'you-can't-use-this-as-proxy-anymore' right?

Insane people still believe they could use my server and they keep trying and trying.

I couldn't block the IP addresses because some of them are using the mobile data (GPRS/UMTS) and that is our market for the website.

Please help.

acid_kewpie · 03-31-2011, 07:11 AM

your config won't stop people making those requests per se, just what will be done with the requests. What is the consequence of doing it? I can request google.com from bing.com's servers if I want, but that doesn't mean they will give it to me. As long as you have ProxyRequests disabled (as per default) then that should get them nothing out of it. http://httpd.apache.org/docs/2.0/mod...#proxyrequests

bathory · 03-31-2011, 07:13 AM

Hi

First of all you should compile mod_proxy, because it could be used by mod_rewrite in some configurations. Using "ProxyRequest Off" should be enough to stop your server acting as a proxy.
Anyway, you can use mod_rewrite to stop proxy requests, like this:

Code:

RewriteEngine On

RewriteCond %{THE_REQUEST} ^GET\ http
RewriteRule (.*) - [F]

Regards

romeo_tango · 03-31-2011, 10:00 AM

Quote:

Originally Posted by acid_kewpie

your config won't stop people making those requests per se, just what will be done with the requests. What is the consequence of doing it? I can request google.com from bing.com's servers if I want, but that doesn't mean they will give it to me. As long as you have ProxyRequests disabled (as per default) then that should get them nothing out of it. http://httpd.apache.org/docs/2.0/mod...#proxyrequests

Hi, so you were saying that :
- It would be enough to set ProxyRequests off
- I can't do any single thing to user that want to use my server as 'proxy' eventhough it is not a proxy, right?

Okay then.
Thanks

romeo_tango · 03-31-2011, 10:02 AM

Quote:

Originally Posted by bathory

Hi

First of all you should compile mod_proxy, because it could be used by mod_rewrite in some configurations. Using "ProxyRequest Off" should be enough to stop your server acting as a proxy.
Anyway, you can use mod_rewrite to stop proxy requests, like this:

Code:

RewriteEngine On

RewriteCond %{THE_REQUEST} ^GET\ http
RewriteRule (.*) - [F]

Regards

hi,

I will try the script from you and see if it will be sufficient to stop the madness. The main cause of this madness is that because somebody already listed our IP address as 'open proxy' in their blog

Thanks for the suggestion..

acid_kewpie · 03-31-2011, 10:22 AM

Quote:

Originally Posted by romeo_tango

Hi, so you were saying that :
- It would be enough to set ProxyRequests off
- I can't do any single thing to user that want to use my server as 'proxy' eventhough it is not a proxy, right?

Okay then.
Thanks

well the point is you can't stop them, as they haven't done anything wrong in asking the question. there *might* be something a tool like fail2ban could do to block them, but i don't know if it can watch apache access logs - have a google. But in apache, no you can't do anything to stop them **TRYING** to do it, but you can stop it working. IF it even is working.