Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
Re: Apache 1.3.27 mod_proxy security issue
From: William A. Rowe, Jr. (wroweapache.org)
Date: Tue Jul 22 2003 - 17:30:39 CDT
The Security Team responded 13 minutes after Jason's initial report,
attempting to explain how he had misconfigured his server. While we
acknowledge that new directives might be desirable in limited cases,
the team determined that this is clearly a user configuration error.
The Apache HTTP Server Documentation Project has been working
to improve and further clarify the risks of open proxies, including open
faux-HTTP proxies into SMTP servers. They actively solicit contributions
to the documentation (preferably with a patch) for any ambiguous or
insufficiently covered topics;
More details follow;
At 11:52 AM 7/22/2003, Jason Robertson wrote:
>I have found that recently a spammer has been using a mod_proxy
>configuration, (that was meant to allow for an easier transition to a
>new naming scheme, as well as changes to a backend software) as a spam
>The spammer has been using HTTP POST requests to send these messages
>with POST HTTP://mailserver:25/ HTTP/1.1
>With some research it looks like this is an automated process including
>the initial scan stage.
>When I contacted Apache in regards to this, the response was not very
>This problem would be a simple fix with implementing the AllowConnect
>configuration option within proxy_http, to prevent outbound
As described in the default configuration, open proxies are never
recommended [from Apache 1.3.27 conf/httpd.conf-dist];
# Proxy Server directives. Uncomment the following lines to
# enable the proxy server:
# ProxyRequests On
# <Directory proxy:*>
# Order deny,allow
# Deny from all
# Allow from .your-domain.com
# Enable/disable the handling of HTTP/1.1 "Via:" headers.
# ("Full" adds the server version; "Block" removes all outgoing Via: headers)
# Set to one of: Off | On | Full | Block
# ProxyVia On
# To enable the cache as well, edit and uncomment the following lines:
# (no cacheing without CacheRoot)
# CacheRoot "ServerRoot/proxy"
# CacheSize 5
# CacheGcInterval 4
# CacheMaxExpire 24
# CacheLastModifiedFactor 0.1
# CacheDefaultExpire 1
# NoCache a-domain.com another-domain.edu joes.garage-sale.com
# End of proxy directives.
If (for the purposes of collecting several machine's collective content)
you are attempting to ProxyPass a number of URI's to different boxes,
you should NOT be enabling ProxyRequests.
The final statements in the ProxyRequests directive documentation are;
"This allows or prevents Apache from functioning as a proxy server.
Setting ProxyRequests to 'off' does not disable use of the <http://httpd.apache.org/docs/mod/mod_proxy.html#proxypass>ProxyPass
"Warning: Do not enable proxying until you have <http://httpd.apache.org/docs/mod/mod_proxy.html#access>secured your server.
Open proxy servers are dangerous both to your network and to the
Internet at large."
Access control is briefly illustrated further with additional references in;