httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From matt.fa...@gmail.com
Subject Re: [users@httpd] mod_proxy_connect security questions
Date Thu, 13 Nov 2008 05:21:26 GMT
Sorry for top post - gooseberry.

Its not clear to me why you are having a proxy around for general use? What happens when you
use a servername that you do not have in your config at all, usually it is matched to the
first virtualhost, have you set up a non-proxy vhost first in the conf?

If you own a firewall, use that to deny requests, generally its done that way, not in apache.
If you do require a TCP proxy for mail, use a dedicated mail transfer agent with SPI/DPI for
that protocol.

The port isn't hard to guess, and the spammer doesn't care, its just software going after
low hanging insecure servers on the standard ports, if the worm the spammer is using wanted
YOUR server it would look for other ways in. Generally the time spent port scanning is time
not spent spamming on another server, but it isn't good to reply on "non-standard" config
to protect you when standard methods do exist to protect you. Modern company firewalls that
do Packet Inspection will stop connect requests to an http proxy on 22 if configured to do
so, expecting to see SSH2 traffic instead!

So basically 
1. Spammers are really just software, they are everywhere, and having a server with standard
ports open writing to a log file means you will start seeing this white noise.

2. Log and look at the response size in bytes, is it the standard size for the status code
given, ie if 403 with a set size in bytes. 

It Is disturbing to see log entries but at least you are checking them!!
Check your firewall logs if you have them, and match up the times to see what's going on.
Block outgoing requests to ports for TCP/UDP apart from ones you need and trust and for those
ports, to the hosts/IPs you trust - outgoing ports 21, 22, 25, 53, 110, 135/7, 443, 445, 500
etc should be only to hosts/IPs you trust. Even 80, unless you truely need this proxy to be
more "open" than that. A web server only needs access to other "trusted" web servers - although
quite what that means I will leave to you. Careful with IP based ACLs though, they change,
so if possible use hosts, and lock down your DNS outgoing to the IP of your ISP.


Matt











Sent from my BlackBerry® wireless device

-----Original Message-----
From: Jens <jens-theisen-tmp01@gmx.de>

Date: Wed, 12 Nov 2008 23:46:25 
To: <users@httpd.apache.org>
Subject: [users@httpd] mod_proxy_connect security questions

Hello,

I set up mod_proxy, mod_proxy_http and mod_proxy_connect on my debian 
box (apache 2.2.3).

After a couple of hours, I got the first spammer trying to abuse it - 
the access log showed

.... CONNECT ...:25 HTTP/1.0 ...

though nothing in the error logs.

iftop tells me, however, that no traffic actually leaves the machine on 
that port, which is what I would expect given that I have turned off 
proxying globally

<IfModule mod_proxy.c>

         ProxyRequests Off
         ProxyVia Off

         <Proxy *>
                 AddDefaultCharset off

                 Order deny,allow
                 Deny from all

                 ProxyFtpDirCharset UTF-8
         </Proxy>

         AllowCONNECT 22

</IfModule>

and allow only CONNECTs to port 22.

I also have a virtual host

<VirtualHost *>
         ServerName ...

         ProxyRequests On

         <Proxy *>
                 Order deny,allow
                 Allow from ...
         </Proxy>

         AllowCONNECT 22

</VirtualHost>

which turns it on, but 1. that would be hard to guess and 2. it still 
should only connect to port 22.

Indeed my own tries to use the non-virtual host proxy fail and the 
virtual hosts ones succeed. So far so good, but now my questions:

1. If the spammer fails to send mail, why does he keep trying? What did 
actually change from his perspective compared to not loading 
mod_proxy_connect at all?
2. Can I somehow get the apache logs to tell me whether the spamming 
succeeds or not? LogLevel debug does not echo a thing more.

I think apache is configured correctly but it's somewhat disturbing to 
see CONNECT sth:25 in the access log while nothing in the error log.

Thank you for your information,

Jens


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Mime
View raw message