<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2653.12">
<TITLE>RE: [Gllug] What's going on?</TITLE>
</HEAD>
<BODY>
<BR>
<BR>
<BR>
<P><FONT SIZE=2>On Tue, 2002-11-19 at 12:04, Jason Clifford wrote:</FONT>
<BR><FONT SIZE=2>> > An entry like this has appeared twice in my apache server log in the last 24</FONT>
<BR><FONT SIZE=2>> > hours:</FONT>
<BR><FONT SIZE=2>> > pool-141-150-114-101.mad.east.verizon.net - - [18/Nov/2002:08:26:41 +0000]</FONT>
<BR><FONT SIZE=2>> > "CONNECT mx00.earthlink.net:25 HTTP/1.0" 405 302 "-" "-"</FONT>
<BR><FONT SIZE=2>> > </FONT>
<BR><FONT SIZE=2>> > Earthlink say it is nothing to be concerned about (no reply from verizon) -</FONT>
<BR><FONT SIZE=2>> > but it looks very odd to me - why is someone trying to get our web server to</FONT>
<BR><FONT SIZE=2>> > attach themselves to their mail server?</FONT>
<BR><FONT SIZE=2>> Indeed. This is a favoured tactic of many spammers.</FONT>
</P>
<P><FONT SIZE=2>yup spammers have moved on to hitting open CONNECT and SOCKS proxies in</FONT>
<BR><FONT SIZE=2>preference to open smtp relays and they're harder to pin down and get</FONT>
<BR><FONT SIZE=2>decent logging out of to determine the source of the spam.</FONT>
</P>
<P><FONT SIZE=2>[...]</FONT>
<BR><FONT SIZE=2>> I do wonder why you are running a public web proxy. Do you really need to?</FONT>
<BR><FONT SIZE=2>> If not set up your acls properly.</FONT>
</P>
<P><FONT SIZE=2>It's probably more a case of a default apache install with mod_proxy</FONT>
<BR><FONT SIZE=2>included and (partially?) configured. Certainly the response indicates</FONT>
<BR><FONT SIZE=2>that it's been rejected properly, however it is going to be worth</FONT>
<BR><FONT SIZE=2>removing the proxy functionality if it's not needed as certain other</FONT>
<BR><FONT SIZE=2>'less savoury' types will use open web proxies for scanning for other</FONT>
<BR><FONT SIZE=2>security holes or trying to download large amounts of copyright</FONT>
<BR><FONT SIZE=2>infringing material or scamming off the likes of porn sites. All using</FONT>
<BR><FONT SIZE=2>someone else's bandwidth (nice people :/)</FONT>
</P>
<BR>
<P><FONT SIZE=2>It is a default install - though with all appropriate paches (as available on rhn) applied. Mod_proxy is not loaded.</FONT>
</P>
<P><FONT SIZE=2>How can you tell (from this log) that we are running a public proxy (I am not aware that we are - but I am not sysadmin here, simply running this server as a test bed for other projects).</FONT></P>
</BODY>
</HTML>