Security – robot hammering apache2

apache-2.2Security

My apache2 log is bombarded with lines like:

108.5.114.118 - - [03/Aug/2012:15:23:28 +0200] "GET http://xchecker.net/tmp_proxy2012/http/engine.php HTTP/1.0" 404 1690 "http://xchecker.net/tmp_proxy2012/http/engine.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"

I am puzzled by this — why is a request for some weird xchecker.net domain ending up on my server in the first place?!

The request comes every few dozens of seconds, must be a robot. Any ideas what it is?

Btw that URL is valid — apparently it contains some test page…

Best Answer

Somebody is checking if your server is a open proxy by requesting:
GET http://xchecker.net/tmp_proxy2012/http/engine.php HTTP/1.0

It doesn't look like you are running an open proxy since it responded with a 404.
For more information on this see: http://wiki.apache.org/httpd/ProxyAbuse
Especially the "But how can I be really sure that I am not allowing the abuse of other sites" part.

We can't tell why it continues to try it even after it should be clear that you don't run a proxy.
Maybe that guys script is broken.

Related Solutions

Apache – Weird Apache Access Log

Those looks like attempts to leverage mod_proxy to get at other parts of the 'net. An incorrectly configured mod_proxy config makes a web-server an open proxy, very valuable for people trying to look like they're not from the place that they actually are. I can't be sure, but that's sure what it looks like to me.

Apache mod_proxy documentation, on access-control:

http://httpd.apache.org/docs/2.0/mod/mod_proxy.html#access

Apache2 – SSL with ECC Configuration

Apache supports ECC Certificates and Protocols as of version 2.2.26. Though if you are using an Apache server from a distro's repository it may be the same version. Ubuntu for example added support in version 2.2.22-1ubuntu1.9.

If you have a version that supports ECC certificates, it should be enabled by default. Assuming you're using OpenSSL, the commands to generate an ECC key and CSR are:

ECC P-256 Key:

openssl ecparam -out server.key -name prime256v1 -genkey

ECC CSR:

openssl req -new -key server.key -out server.csr

The installation steps for ECC certs in Apache are identical to RSA. You'd still specify the public key entry, private key entry, and the relevant intermediates. Just double check that your CA supports the issuance of ECC certificates. You can double check ECC compatibility to address any concerns with connecting clients.

Best Answer

Related Solutions

Apache – Weird Apache Access Log

Apache2 – SSL with ECC Configuration

Related Topic