You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Robert Moskowitz <rg...@htt-consult.com> on 2003/03/26 15:39:08 UTC
[users@httpd] Setting up proxing and stopping POST SMTP
I have just upgraded from 1.3.20 to 2.0.44
Lots of reasons for the upgrade, most noteably those nasty HTTP-POST SMTPs.
But I have to have proxy working from my domain (actually from my SSH
tunnel server), and I can't get the proxy working and can't tell if I am
stopping POST SMTPs.
Here is what I have done so far:
I have commented out the following modules:
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_connect_module modules/mod_proxy_connect.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
I added the following commands:
<IfModule mod_proxy.c>
ProxyRequests On
<Proxy *>
Order Deny,Allow
Deny from all
Allow from htt-consult.com
</Proxy>
</IfModule>
First, I had to add the </IfModule> to get the conf to compile. This
command was not in the commented sample code.
This still does not work. Proxying is not working.
For stopping the POST SMTP I added the following that I guessed I was to do
(from the archives here):
<IfModule mod_proxy.c>
ProxyRequests On
<Proxy *>
Order Deny,Allow
Deny from all
Allow from htt-consult.com
</Proxy>
<Directory proxy *>
<LimitExcept GET HEAD POST>
Order deny,allow
Deny from all
</LimitExcept>
</Directory>
</IfModule>
I get a conf test error on this:
Multiple <Directory> arguments are not (yet) supported.
Can I get some guidance???
Illegitimi non Carborundum
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Setting up proxing and stopping POST SMTP
Posted by Robert Moskowitz <rg...@htt-consult.com>.
At 04:19 PM 3/27/2003 +1100, Zac Stevens wrote:
>It doesn't work because the argument to <Directory> is a path on the
>filesystem. This is clearly explained in the documentation:
>
>http://httpd.apache.org/docs-2.0/mod/core.html#directory
>
>You should be able to put the LimitExcept rules into your <Proxy *> block.
>
>I would suggest reading the documentation on section containers for
>additional information:
>
>http://httpd.apache.org/docs-2.0/sections.html
Oh, I read it all, and the text I used was lifted right out of the
docs. Of course now I can't find that URL (did not bookmark it) to show a
doc error :)
And I have spent considerable time with the docs. I guess I am just not
groking the doc layout. I cannot find any thing on LimitExcept. Did a
search. Plowed around.
Is this even the right content to stop. Or is the nature of the attack so
varied that I will spend a month setting up all sorts of filters and the
only effective filter is to only allow proxying from trusted IP addresses?
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Setting up proxing and stopping POST SMTP
Posted by Zac Stevens <zt...@cryptocracy.com>.
On Thu, Mar 27, 2003 at 12:09:15AM -0500, Robert Moskowitz wrote:
> But I am still concerned that someone might find a way to use one of my IP
> addresses to do the POST SMTP, and would like to figure out why
>
> <Directory proxy *>
<--snip-->
> is bad syntax and if this is the right syntax....
It doesn't work because the argument to <Directory> is a path on the
filesystem. This is clearly explained in the documentation:
http://httpd.apache.org/docs-2.0/mod/core.html#directory
You should be able to put the LimitExcept rules into your <Proxy *> block.
I would suggest reading the documentation on section containers for
additional information:
http://httpd.apache.org/docs-2.0/sections.html
Cheers,
Zac
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] Setting up proxing and stopping POST SMTP
Posted by Robert Moskowitz <rg...@htt-consult.com>.
At 06:23 PM 3/26/2003 -0500, Jeff Cohen wrote:
>Are you talking about a Proxy Server or the Proxy functionality in the
>Apache Web Server?
Proxy functionality in the Apache Web Server. I only have the one
system. This is a small operation despite the /26 allocation.
Anyway, I now have the basic proxying working. See my previous note. It
is appalling how many GETs there are to access www.cnn.com!
Also I believe the proxy limiting to my address range also stops the POST
SMTP proxies:
segfault.monkeys.com - - [26/Mar/2003:23:40:06 -0500] "CONNECT
outland.monkeys.com:25 HTTP/1.0" 403 309
But I am still concerned that someone might find a way to use one of my IP
addresses to do the POST SMTP, and would like to figure out why
<Directory proxy *>
<LimitExcept GET HEAD POST>
Order deny,allow
Deny from all
</LimitExcept>
</Directory>
is bad syntax and if this is the right syntax....
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] Setting up proxing and stopping POST SMTP
Posted by Jeff Cohen <li...@gej-it.com>.
Are you talking about a Proxy Server or the Proxy functionality in the
Apache Web Server?
Jeff Cohen
> -----Original Message-----
> From: Robert Moskowitz [mailto:rgm@htt-consult.com]
> Sent: Wednesday, March 26, 2003 10:01 AM
> To: users@httpd.apache.org; users@httpd.apache.org
> Subject: Re: [users@httpd] Setting up proxing and stopping POST SMTP
>
> At 09:51 AM 3/26/2003 -0500, Jeff Cohen wrote:
> >hi Robert,
> >
> >What is the exact Location that you want to be proxied?
> >from what I understand you are trying to have http://yourdomain.com/proxy
> >to be filtered, is that right?
>
> I am trying to set up the server so that systems in my domain can use it
as
> a proxy to get to out.
>
> In particular, when I am on the road, I SSH back to my domain and run
SMTP,
> POP3, and HTTP through the tunnel.
>
> Of course my SMTP and POP3 servers are local. This gives those unsecured
> protocols needed security.
>
> For HTTP, my desire is to not expose what I do (like bank access and the
> like) on wireless networks and the like. So I set up my browse to proxy
to
> Localhost, and SSH tunnels port 80 to my web server. This was working
with
> 1.3. Now I want it working with 2.0.
>
> And with proxy on, not to let the bas*ards relay SMTP spam through my
> server....
>
>
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Setting up proxing and stopping POST SMTP
Posted by Robert Moskowitz <rg...@htt-consult.com>.
At 09:51 AM 3/26/2003 -0500, Jeff Cohen wrote:
>hi Robert,
>
>What is the exact Location that you want to be proxied?
>from what I understand you are trying to have http://yourdomain.com/proxy
>to be filtered, is that right?
I am trying to set up the server so that systems in my domain can use it as
a proxy to get to out.
In particular, when I am on the road, I SSH back to my domain and run SMTP,
POP3, and HTTP through the tunnel.
Of course my SMTP and POP3 servers are local. This gives those unsecured
protocols needed security.
For HTTP, my desire is to not expose what I do (like bank access and the
like) on wireless networks and the like. So I set up my browse to proxy to
Localhost, and SSH tunnels port 80 to my web server. This was working with
1.3. Now I want it working with 2.0.
And with proxy on, not to let the bas*ards relay SMTP spam through my
server....
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Setting up proxing and stopping POST SMTP
Posted by Jeff Cohen <li...@gej-it.com>.
hi Robert,
What is the exact Location that you want to be proxied?
from what I understand you are trying to have http://yourdomain.com/proxy
to be filtered, is that right?
Jeff Cohen
-----Original Message-----
From: Robert Moskowitz <rg...@htt-consult.com>
To: users@httpd.apache.org
Date: Wed, 26 Mar 2003 09:39:08 -0500
Subject: [users@httpd] Setting up proxing and stopping POST SMTP
> I have just upgraded from 1.3.20 to 2.0.44
>
> Lots of reasons for the upgrade, most noteably those nasty HTTP-POST
> SMTPs.
>
> But I have to have proxy working from my domain (actually from my SSH
> tunnel server), and I can't get the proxy working and can't tell if I
> am
> stopping POST SMTPs.
>
> Here is what I have done so far:
>
> I have commented out the following modules:
>
> LoadModule proxy_module modules/mod_proxy.so
> LoadModule proxy_connect_module modules/mod_proxy_connect.so
> LoadModule proxy_http_module modules/mod_proxy_http.so
> LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
>
>
> I added the following commands:
>
> <IfModule mod_proxy.c>
> ProxyRequests On
> <Proxy *>
> Order Deny,Allow
> Deny from all
> Allow from htt-consult.com
> </Proxy>
> </IfModule>
>
> First, I had to add the </IfModule> to get the conf to compile. This
> command was not in the commented sample code.
>
> This still does not work. Proxying is not working.
>
> For stopping the POST SMTP I added the following that I guessed I was
> to do
> (from the archives here):
>
> <IfModule mod_proxy.c>
> ProxyRequests On
> <Proxy *>
> Order Deny,Allow
> Deny from all
> Allow from htt-consult.com
> </Proxy>
> <Directory proxy *>
> <LimitExcept GET HEAD POST>
> Order deny,allow
> Deny from all
> </LimitExcept>
> </Directory>
> </IfModule>
>
> I get a conf test error on this:
>
> Multiple <Directory> arguments are not (yet) supported.
>
> Can I get some guidance???
>
>
> Illegitimi non Carborundum
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server
> Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org