[users@httpd] Securing Reverse Proxy against abuse by spammers

[Robert Schwenk <li...@yahoo.com>]

We are using Apache as a reverse proxy for connecting
to a local application server.

We recently received an email message containing the
following notice:

 while talking to mailin-03.mx.aol.com.:
<<< 550-The IP address you're using to connect to AOL
is either open to the
<<< 550-free relaying of e-mail, is serving as an open
proxy, or is a dynamic
<<< 550-(residential) IP address.  AOL cannot accept
further e-mail
<<< 550-transactions from your server until either
your server is closed to free
<<< 550-relaying/proxy, or your ISP removes your IP
address from their list of
<<< 550-dynamic IP addresses. For additional
information, please visit
<<< 550 http://postmaster.info.aol.com.

I then visited the URL mentioned and tested our IP
address. I next received a message saying that our
port 80 was an open proxy:

You are receiving this message because someone, who is
having
difficulty sending email to AOL, used AOL's open proxy
tester
tool at postmaster.info.aol.com to notify you that
this server
is serving as an open proxy and is blocked by AOL.  
Anyone using this server will be unable to send mail
to AOL
members until open proxy service is disabled on your
server.

I believe the test from Aol for an open proxy was
logged as follows:

152.163.224.70 - - [29/Apr/2003:11:26:12 -0500] "POST
http://ort-r01.mx.aol.com:80 HTTP/1.1" 200 220 "-" "-"

Here is an extract from our httpd.conf file:

<IfModule mod_proxy.c>
    ProxyRequests On
    SetEnvIf Host "localhost" ourdomain
    SetEnvIf Host "ourdomain\.org$" ourdomain
    <Directory proxy:*>
        Order deny,allow
        Deny from all
        Allow from env=ourdomain
    </Directory>
</IfModule>
<VirtualHost *:80>
ServerName ourdomain.org
ProxyPass / http://localhost:8888/webapp/
ProxyPassReverse / http://localhost:8888/webapp/
</VirtualHost>

Any suggestions on locking down the proxy further so
that the proxy can only be used to access our own
local urls?

Thanks for your help!

__________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.
http://search.yahoo.com

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org