[users@httpd] R: [users@httpd] Security problem with mod_proxy

[trashMan <tr...@httconsulting.com>]

Sorry but...i'm deprived of hope!

I've an application server and i use apache as front end so apache must
redirect only the request for Zope (the app.server). I use the virtualhost
and rewriterule with [p] flag for activate the reverse proxy. 

With  ProxyRequests Off directive the forward proxy is disable but the
problem persists.

What can i do?? 

They are 3 days and 3 nights that I am studying like resolving and I do not
succeed to find the solution :-(

I think that must use the module <proxy> but I do not know like:

<Proxy *>
Order deny,allow
Deny from all
</Proxy>

All it is blocked while the demands for my application server on port 8080
must pass

Excused and  Thanks for your answer

Massimiliano


-----Messaggio originale-----
Da: Andre Malo [mailto:nd@perlig.de] 
Inviato: domenica 1 febbraio 2004 12.34
A: users@httpd.apache.org
Oggetto: Re: [users@httpd] Security problem with mod_proxy

On Sun, 1 Feb 2004 12:26:22 +0100
"trashMan" <tr...@httconsulting.com> wrote:

> I've a big problem with security!!
> I use apache with mod_proxy and rewriterule with zope Application 
> Server and there are a lot of server that use my apache as proxy 
> without permission!

How do you know?

> I know that mod_proxy is open by default so i've inserted in 
> httpd.conf

Who told you that? The docs had told you something else:
http://httpd.apache.org/docs-2.0/mod/mod_proxy.html#proxyrequests

Default is "off".

nd

P.S.: Please don't post unrelated config stuff here, it's just annoying and
not helpful by any means.

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org



---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org