I've just started in a new company, and have been going over the setup of their Apache webserver conf files… only to find that they've had their apache servers set up as open proxies available to all the world for the last two months. I've already set ProxyRequests Off in the httpd.conf file and restarted the web server, but the access log file is still growing at a horrendous rate (about a gig a day). I noticed that another question was posted on here about this (Apache hit with proxy request), but their access log was supposedly returning 404 errors, while mine appears to be returning 403 and 404 codes… Is this correct?

Here are a few lines out of my access log:

87.118.118.124 - - [16/Mar/2010:10:56:36 -0400] "GET http://www.c5interlude.ru/torrent/viewtopic.php?p=2501 HTTP/1.0" 404 219 "http://www.c5interlude.ru/torrent/viewtopic.php?p=2501" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
117.41.184.27 - - [16/Mar/2010:10:56:36 -0400] "GET http://ad.xtendmedia.com/st?ad_type=iframe&ad_size=300x250&section=790074 HTTP/1.0" 404 200 "http://www.newbiegamer.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Alexa Toolbar)"
122.224.55.222 - - [16/Mar/2010:10:56:36 -0400] "GET http://www.188woool.net/\xb4\xf3\xd4\xcb\xb4\xab\xca\xc0.rar HTTP/1.1" 403 214 "http://www.188woool.net/\xb4\xf3\xd4\xcb\xb4\xab\xca\xc0.rar" "Mozilla/4.0"
58.55.21.40 - - [16/Mar/2010:10:56:36 -0400] "GET http://www.cpx24.com/ad1.js HTTP/1.0" 404 204 "http://thebighits.com/?id=aibux" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
122.226.223.188 - - [16/Mar/2010:10:56:36 -0400] "GET http://ad.reduxmedia.com/st?ad_type=iframe&ad_size=160x600&section=798636 HTTP/1.0" 404 200 "http://www.gvvu.com" "Mozilla/4.0 (compatible; MSIE 5.5; AOL 6.0; Windows 98; Win 9x 4.90)"
84.51.109.31 - - [16/Mar/2010:10:56:36 -0400] "GET http://www.kslp.ru/forum/index.php HTTP/1.0" 404 213 "http://www.kslp.ru/forum/index.php" "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0 ; .NET CLR 2.0.50215; SL Commerce Client v1.0; Tablet PC 2.0"
122.224.48.49 - - [16/Mar/2010:10:56:36 -0400] "GET http://www1.vip218.com/\xb2\xca\xba\xe7\xb4\xab\xca\xc0.exe HTTP/1.1" 403 214 "http://www1.vip218.com/\xb2\xca\xba\xe7\xb4\xab\xca\xc0.exe" "Mozilla/4.0"
117.41.184.27 - - [16/Mar/2010:10:56:36 -0400] "GET http://ad.xtendmedia.com/st?ad_type=iframe&ad_size=728x90&section=657624 HTTP/1.0" 404 200 "http://www.raiseanimals.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Alexa Toolbar)"

And my corresponding error log entries:

[Tue Mar 16 10:56:36 2010] [error] [client 87.118.118.124] File does not exist: C:/public_html/torrent, referer: http://www.c5interlude.ru/torrent/viewtopic.php?p=2501
[Tue Mar 16 10:56:36 2010] [error] [client 117.41.184.27] File does not exist: C:/public_html/st, referer: http://www.newbiegamer.com
[Tue Mar 16 10:56:36 2010] [error] [client 122.224.55.222] (22)Invalid argument: Cannot map GET http://www.188woool.net/\xb4\xf3\xd4\xcb\xb4\xab\xca\xc0.rar HTTP/1.1 to file, referer: http://www.188woool.net/\xb4\xf3\xd4\xcb\xb4\xab\xca\xc0.rar
[Tue Mar 16 10:56:36 2010] [error] [client 58.55.21.40] File does not exist: C:/public_html/ad1.js, referer: http://thebighits.com/?id=aibux
[Tue Mar 16 10:56:36 2010] [error] [client 122.226.223.188] File does not exist: C:/public_html/st, referer: http://www.gvvu.com
[Tue Mar 16 10:56:36 2010] [error] [client 84.51.109.31] File does not exist: C:/public_html/forum, referer: http://www.kslp.ru/forum/index.php
[Tue Mar 16 10:56:36 2010] [error] [client 122.224.48.49] (22)Invalid argument: Cannot map GET http://www1.vip218.com/\xb2\xca\xba\xe7\xb4\xab\xca\xc0.exe HTTP/1.1 to file, referer: http://www1.vip218.com/\xb2\xca\xba\xe7\xb4\xab\xca\xc0.exe
[Tue Mar 16 10:56:36 2010] [error] [client 117.41.184.27] File does not exist: C:/public_html/st, referer: http://www.raiseanimals.com

Does this in fact look like the server is blocking them correctly, and is there anything else that I could do better to cut down on my access log size? (perhaps block these requests from the server completely?)

Thanks!
Matt

UPDATE:

These are the successful proxies… But I haven't enabled ProxyRequests!! (It didn't even show up in my httpd.conf file (defaulting to no) but have since added ProxyRequests Off as the 4th line in my httpd.conf file).

95.211.14.24 - - [03/Jun/2010:12:01:24 -0400] "CONNECT mail.yahoo.com:443" 200 6103 "-" "-"
98.126.74.66 - - [03/Jun/2010:12:01:39 -0400] "CONNECT intlreg.aol.com:443 HTTP/1.1" 200 6103 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Maxthon; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) )"
98.126.74.66 - - [03/Jun/2010:12:01:40 -0400] "\x16\x03\x01" 200 6103 "-" "-"
91.5.169.251 - - [03/Jun/2010:12:01:43 -0400] "GET http://shop.breho-tools.de/index.php?cat=c95_Doppelhobel.html HTTP/1.0" 200 6103 "-" "-"
114.25.230.147 - - [03/Jun/2010:12:01:50 -0400] "CONNECT mail2000.com.tw:25 HTTP/1.0" 200 6103 "-" "-"
67.208.112.37 - - [03/Jun/2010:12:02:02 -0400] "GET http://yahoo.com:80/ HTTP/1.1" 200 6103 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 GTB7.0 (.NET CLR 3.5.30729)"
67.208.112.37 - - [03/Jun/2010:12:02:18 -0400] "GET http://yahoo.com:80/ HTTP/1.1" 200 6103 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 GTB7.0 (.NET CLR 3.5.30729)"
69.132.95.188 - - [03/Jun/2010:12:02:33 -0400] "GET http://login.vip.kr3.yahoo.com/config/isp_verify_user?l=_sunflowerwoman&p=%20%20%20%20%20 HTTP/1.0" 404 220 "-" "-"
120.37.91.109 - - [03/Jun/2010:12:02:37 -0400] "GET http://543b5be9.linkbucks.com/ HTTP/1.1" 200 6103 "http://dns.ladymx.com:1108/shangcheng/" "Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB6; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; InfoPath.2; .NET CLR 3.0.30729)"
120.37.91.109 - - [03/Jun/2010:12:02:37 -0400] "GET http://543b5be9.linkbucks.com/RecordClick.aspx?id=&key=&ref=&cacheBust=80493192 HTTP/1.1" 404 214 "http://dns.ladymx.com:1108/shangcheng/" "Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB6; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; InfoPath.2; .NET CLR 3.0.30729)"
120.37.91.109 - - [03/Jun/2010:12:02:40 -0400] "GET http://543b5be9.linkbucks.com/RecordClick.aspx?id=&key=&ref=&cacheBust=80493192 HTTP/1.1" 404 214 "http://dns.ladymx.com:1108/shangcheng/" "Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB6; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; InfoPath.2; .NET CLR 3.0.30729)"
66.77.255.230 - - [03/Jun/2010:12:02:40 -0400] "GET http://proxyjudge1.proxyfire.net/fastenv HTTP/1.1" 404 205 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
120.37.91.109 - - [03/Jun/2010:12:02:42 -0400] "GET http://543b5be9.linkbucks.com/RecordClick.aspx?id=&key=&ref=&cacheBust=80493192 HTTP/1.1" 404 214 "http://dns.ladymx.com:1108/shangcheng/" "Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB6; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; InfoPath.2; .NET CLR 3.0.30729)"
89.149.223.112 - - [03/Jun/2010:12:02:43 -0400] "CONNECT mail.yahoo.com:443" 200 6103 "-" "-"
95.211.0.132 - - [03/Jun/2010:12:02:49 -0400] "CONNECT mail.yahoo.com:443" 200 6103 "-" "-"
217.133.52.34 - - [03/Jun/2010:12:02:52 -0400] "GET http://www.naturalintegrator.com/buoni-regalo-c-21.html HTTP/1.1" 404 220 "http://www.mylevis.us/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)"