| View previous topic :: View next topic |
| Author |
Message |
Corona688
Veteran
Joined: 10 Jan 2004
Posts: 1204
|
 Posted: Thu Nov 30, 2006 6:41 pm Post subject: [SOLVED] Apache2 compromised |
 |
|
I should not be seeing things like this in my log.
| Code: | | 220.231.44.219 - - [30/Nov/2006:12:40:31 -0600] "GET http://www.yahoo.com/ HTTP/1.0" 200 1894 |
WTF does it think it's doing? How do I stop it?
_________________
Petition for Better 64-bit ATI Drivers - Sign Here
http://www.petitiononline.com/atipet/petition.html
Last edited by Corona688 on Thu Nov 30, 2006 8:05 pm; edited 1 time in total |
|
| Back to top |
|
 |
DocReedSolomon
Guru
Joined: 28 Aug 2006
Posts: 419
|
| Posted: Thu Nov 30, 2006 6:45 pm Post subject: |
|
|
there was probably more than this one line with that address, probably trying to call an exe file?
looks like a compromised win client or bot, fakeing the referer. nothing to worry about, i get those all the time  |
|
| Back to top |
|
|
Corona688
Veteran
Joined: 10 Jan 2004
Posts: 1204
|
| Posted: Thu Nov 30, 2006 7:10 pm Post subject: |
|
|
The problem is not that he's trying to get yahoo.com through my server. The problem is that HE'S SUCCEEDING. Look at the code -- 200 OK.
_________________
Petition for Better 64-bit ATI Drivers - Sign Here
http://www.petitiononline.com/atipet/petition.html |
|
| Back to top |
|
|
DocReedSolomon
Guru
Joined: 28 Aug 2006
Posts: 419
|
| Posted: Thu Nov 30, 2006 7:15 pm Post subject: |
|
|
ah. do you have a link to yahoo on your webpage? then he probably clicked that one?
//edit: you do have a link on your webpage to yahoo. so why do you worry if it actually works? 
i just clicked it right now on your page, check your log. |
|
| Back to top |
|
|
Corona688
Veteran
Joined: 10 Jan 2004
Posts: 1204
|
| Posted: Thu Nov 30, 2006 7:27 pm Post subject: |
|
|
No. No, you didn't. My webserver is DISABLED until I figure out how to stop this. I don't know where you went. 
Clicking a link to yahoo.com wouldn't tell my web server anything, besides. The access would go to yahoo. That's what links do. Somebody has been using my web server as a proxy, I think, and I don't know how to disable it.
Any other ideas?
_________________
Petition for Better 64-bit ATI Drivers - Sign Here
http://www.petitiononline.com/atipet/petition.html |
|
| Back to top |
|
|
DocReedSolomon
Guru
Joined: 28 Aug 2006
Posts: 419
|
| Posted: Thu Nov 30, 2006 7:31 pm Post subject: |
|
|
hmm, i am talking about http://www.petitiononline.com
it is not disabled, and it does have a link to yahoo.
proxy access wouldnt be in your apache log either, this just btw |
|
| Back to top |
|
|
DocReedSolomon
Guru
Joined: 28 Aug 2006
Posts: 419
|
| Posted: Thu Nov 30, 2006 7:32 pm Post subject: |
|
|
| Corona688 wrote: |
Clicking a link to yahoo.com wouldn't tell my web server anything |
sure it does! |
|
| Back to top |
|
|
Corona688
Veteran
Joined: 10 Jan 2004
Posts: 1204
|
| Posted: Thu Nov 30, 2006 7:39 pm Post subject: |
|
|
That petition is not my web site.
And no, no it doesn't. I just triple-checked, on a different server, to make sure my understanding of web isn't horribly fundamentally wrong:
| Code: | 192.168.0.22 - - [30/Nov/2006:13:34:33 -0600] "GET /~tyler/perfect.html HTTP/1.1" 200 670
192.168.0.22 - - [30/Nov/2006:13:34:33 -0600] "GET /~tyler/styles.css HTTP/1.1" 200 6106 |
I load the page, then click a yahoo link on it. The log shows my page loads. It does NOT show me clicking on yahoo. Which makes sense. The link brings you to yahoo. I am not yahoo. I have never been yahoo. I don't even want to BE yahoo.
What is happening is that someone is saying, "Hey, Corona's server, would you fetch me yahoo.com please?" and my server, being extravagantly misconfigured somehow, says "Sure!" and gives it the page instead of giving an invalid indirection or something. I've got megabytes of log entries of this, and my ISP's complained. My output bandwidth consumption is identical to my input, so it's obviously proxying despite your claims. Can you please stop dicking around and help me?
_________________
Petition for Better 64-bit ATI Drivers - Sign Here
http://www.petitiononline.com/atipet/petition.html |
|
| Back to top |
|
|
DocReedSolomon
Guru
Joined: 28 Aug 2006
Posts: 419
|
| Posted: Thu Nov 30, 2006 7:49 pm Post subject: |
|
|
| Corona688 wrote: | | I've got megabytes of log entries of this, and my ISP's complained |
that makes the story look completly different.
sorry, didnt want to step on your toes, but you could have mentioned this in the first place.
could have avoided a lot of confusion.
| Corona688 wrote: |
and my server, being extravagantly misconfigured somehow
|
so how are we able to help there?
we know nothing about your server config, and my crystal ball is on holiday right now.
as i mentioned in my first post, this one line is simply not enough. |
|
| Back to top |
|
|
Corona688
Veteran
Joined: 10 Jan 2004
Posts: 1204
|
| Posted: Thu Nov 30, 2006 8:03 pm Post subject: |
|
|
Found it.
If I'd posted my config file it wouldn't have helped you a bit. I'd already removed the file that enabled my (supposedly extremely limited) proxy in /etc/apache2/modules.d/... The problem was actually in apache2-builtin-mods, where I had to change:
| Code: | mod_proxy shared
mod_proxy-connect shared
mod_proxy-ftp shared
mod_proxy-http shared |
to | Code: | - mod_proxy shared
- mod_proxy-connect shared
- mod_proxy-ftp shared
- mod_proxy-http shared |
And now, instead of proxying content for them, my web server is giving them beautiful 404's.
I must say I'm quite curious where you get this idea that my server was getting records of where people clicked. Were you thinking of referrers? That's kind of backwards with respect to how referrers work -- my server isn't told that people are going to yahoo, but yahoo would get told that people are coming from my server...
_________________
Petition for Better 64-bit ATI Drivers - Sign Here
http://www.petitiononline.com/atipet/petition.html |
|
| Back to top |
|
|
DocReedSolomon
Guru
Joined: 28 Aug 2006
Posts: 419
|
| Posted: Thu Nov 30, 2006 8:12 pm Post subject: |
|
|
nice workaround. even more misconfigured now, though - worked for you
it is really your believe everyone in here changed *that* file and disabled those? ah well..
my money is on commonapache2.conf. looks like you enabled the proxy services there. they are disabled by default, this just btw..
could it not be you enabled them there? |
|
| Back to top |
|
|
Corona688
Veteran
Joined: 10 Jan 2004
Posts: 1204
|
| Posted: Thu Nov 30, 2006 9:47 pm Post subject: |
|
|
You really know very little about apache, do you? Pity you're the only one that bothered replying instead of people who might have helped.
The proxy modules are used for... proxy. I don't need them if I no longer want my web server to be a proxy. Now if I'd deleted them to stop them, that would be a workaround, this was just restoring my system to original settings. I had to enable those modules to get the proxy working, I'd quite forgotten about that file. And I didn't just blithely edit the file... I systematically ruled out every apache-related config file in the entire sytem before I resolved to edit the list of modules. I even checked every .htaccess on the system to make sure it wasn't hiding in them. There's literally nowhere else I could disable it.
I haven't modified commonapache.conf since last year. You almost never need to. Most of the relevant changes actually happen in /etc/conf.d/apache2 and /etc/apache2/modules.d the way gentoo has it set up -- you turn on and off defines that control which <IfDefined> statements happen in the apache config files.
No, I did not enable the services in commonapache.conf. I enabled PROXY in /etc/conf.d/apache2 then enabled the necessary modules for it to work. I aso had an /etc/apache2/modules.d/80-proxy file that I made myself that was SUPPOSED to secure it but obviously did not.
_________________
Petition for Better 64-bit ATI Drivers - Sign Here
http://www.petitiononline.com/atipet/petition.html |
|
| Back to top |
|
|
|
Networking & Security
