Re: [users@httpd] Preventing an open proxy with both a single SSL virtual host and a non-SSL virtual host

2014-02-18 Thread Tom Evans
On Tue, Feb 18, 2014 at 3:00 PM, Richard Mixon wrote: > Jonas/Yehuda, > > The example I chose was a bad one, just rushing to get the mail out I guess. > The vast majority of the requests have a return of 200, with a few 503. > Yes, your configuration is not right - you are configuring a reverse

Re: [users@httpd] Preventing an open proxy with both a single SSL virtual host and a non-SSL virtual host

2014-02-18 Thread Igor Cicimov
I use this to block relay proxy attempts: RewriteCond %{THE_REQUEST} ^[A-Z]+\ /?https?:// [NC] RewriteCond %{THE_REQUEST} !^[A-Z]+\ /?https?://([^.]+\.)?mydomain\.com RewriteRule .* - [F] On Wed, Feb 19, 2014 at 2:00 AM, Richard Mixon wrote: > Jonas/Yehuda, > > The example I chose was a bad on

Re: [users@httpd] Preventing an open proxy with both a single SSL virtual host and a non-SSL virtual host

2014-02-18 Thread Richard Mixon
Jonas/Yehuda, The example I chose was a bad one, just rushing to get the mail out I guess. The vast majority of the requests have a return of 200, with a few 503. I hope this reply goes through - I've waited a few days. Earlier replies to the list keep getting rejected due to SPAM scores - I ke

Re: [users@httpd] Preventing an open proxy with both a single SSL virtual host and a non-SSL virtual host

2014-02-18 Thread Jonas Eckerman
Just commenting on you're logged request, not your config... What was it that made you think you had an open proxy? Was it only requests like the one below? Where they all answered with status 403? Richard Mixon wrote: > After that we started getting flooded with requests such as the followin

Re: [users@httpd] Preventing an open proxy with both a single SSL virtual host and a non-SSL virtual host

2014-02-14 Thread Yehuda Katz
Are those odd requests actually working? From your log it look like they get a 403 error which is exactly what your configuration is saying should happen. - Y (Had to remove your links so this would get through the spam filter) On Thu, Feb 13, 2014 at 2:16 AM, Richard Mixon wrote: > > We've set

[users@httpd] Preventing an open proxy with both a single SSL virtual host and a non-SSL virtual host

2014-02-12 Thread Richard Mixon
We've setup a new Apache server on Centos 6.4, httpd 2.2.15. The site is running SSL with a single Wordpress virtual host. We do use mod_proxy to forward some requests to back-end systems our CAS authentication system and a couple of other back-end systems we need a limited amount of content from.