OK. You want to identify all non-local requests and nullify them. I am away from a terminal at the moment, so I'll be able to do it in an hour. <br><br>Chris <br><br><div class="gmail_quote">On Thu, Oct 25, 2012 at 9:19 AM, Levente Uzonyi <span dir="ltr"><<a href="mailto:leves@elte.hu" target="_blank">leves@elte.hu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">The ProxyRequests Off line stops apache working as a forward proxy. The <proxy> block is only necessary to allow proxying if other parts of the apache config deny it (default on most linuxes). More details here: <a href="https://wiki.jenkins-ci.org/display/JENKINS/Running+Jenkins+behind+Apache" target="_blank">https://wiki.jenkins-ci.org/<u></u>display/JENKINS/Running+<u></u>Jenkins+behind+Apache</a><br>
<br>
Currently the server returns a 200 response for all non-local request, but it serves the jenkins page instead of what was requested. In order to get rid of this extra load we should reject all non-local requests. It can be done with RewriteEngine:<br>
<br>
execute: sudo a2enmod rewrite<br>
<br>
add the following to the configuration:<br>
<br>
RewriteEngine On<br>
RewriteCond %{THE_REQUEST} ^GET\ http(s?)://<br>
RewriteRule .* - [F]<br>
<br>
Then restart apache.<span class="HOEnZb"><font color="#888888"><br>
<br>
<br>
Levente</font></span><div class="HOEnZb"><div class="h5"><br>
<br>
On Thu, 25 Oct 2012, Chris Cunnington wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Levente was right about the open proxy exploitation. [1] It has stopped now. [Editor's Note: No it hasn't.] The last one was at 7:52 on 23 Oct. This server is on CEST time, so subtracting six hours that would be 1:52 here in eastern North America. The GET requests display explotation when they are asking for a server that is not ours. The request for <a href="http://ad.yieldmanager.com" target="_blank">http://ad.yieldmanager.com</a> is an example. I don't suppose there's any real damage, but it is my mistake.<br>
<br>
The open proxy exploitation was followed by many POST requests. [2] Notice the size of this log file:<br>
<br>
-rw-r----- 1 root adm <a href="tel:2173022665" value="+12173022665" target="_blank">2173022665</a> Oct 25 14:20 other_vhosts_access.log<br>
<br>
What is that? To my eyes that's 2.02 Gigs of data collected over maybe ~72 hours. Many [2] are POST requests. I can't say what ajaxExecutors or ajaxBuildQueue is. It is definitely part of Jenkins, I'm just not sure what part. I'll look into it.<br>
<br>
Actually, I'm wrong. [3]. We're still being exploited as an open proxy. Those are the latest results from the log file.<br>
<br>
I've changed the stanza to and restarted:<br>
<br>
<VirtualHost *:80><br>
ServerName <a href="http://www.squeakci.org" target="_blank">www.squeakci.org</a><br>
ServerAlias <a href="http://squeakci.org" target="_blank">squeakci.org</a><br>
ProxyRequests Off<br>
ProxyPreserveHost On<br>
ProxyPass / <a href="http://127.0.0.1:8080/" target="_blank">http://127.0.0.1:8080/</a><br>
ProxyPassReverse / <a href="http://127.0.0.1:8080/" target="_blank">http://127.0.0.1:8080/</a><br>
<Proxy *><br>
Order deny,allow<br>
Allow from all<br>
</Proxy><br>
</VirtualHost><br>
<br>
And will check the log file again in two hours.<br>
<br>
Chris<br>
<br>
<br>
[1]<br>
<br>
92.17.231.188 - - [23/Oct/2012:07:52:54 +0200] "POST /ajaxExecutors HTTP/1.1" 200 545 "<a href="http://squeakci.org/" target="_blank">http://squeakci.org/</a>" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/536.26.14 (KHTML, like Gecko) Version/6.0.1 Safari/536.26.14"<br>
<a href="http://www.squeakci.org:80" target="_blank">www.squeakci.org:80</a> 92.17.231.188 - - [23/Oct/2012:07:52:55 +0200] "POST /ajaxBuildQueue HTTP/1.1" 200 415 "<a href="http://squeakci.org/" target="_blank">http://squeakci.org/</a>" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/536.26.14 (KHTML, like Gecko) Version/6.0.1 Safari/536.26.14"<br>
<a href="http://www.squeakci.org:80" target="_blank">www.squeakci.org:80</a> 184.22.82.217 - - [23/Oct/2012:07:52:55 +0200] "GET <a href="http://ad.yieldmanager.com/st?ad_type=iframe&ad_size=300x250&section=3007994&pub_url=$%7BPUB_URL%7D" target="_blank">http://ad.yieldmanager.com/st?<u></u>ad_type=iframe&ad_size=<u></u>300x250&section=3007994&pub_<u></u>url=${PUB_URL}</a> HTTP/1.0" 200 4982 "<a href="http://www.file4dvd.com" target="_blank">http://www.file4dvd.com</a>" "Mozilla/4.0 (compatible; MSIE 5.01; Windows 98)"<br>
<a href="http://www.squeakci.org:80" target="_blank">www.squeakci.org:80</a> 184.22.82.217 - - [23/Oct/2012:07:52:56 +0200] "GET <a href="http://ad.yieldmanager.com/imp?Z=300x250&s=3007994&T=3&_salt=1911752854&B=12&m=2&u=http%3A%2F%2Fwww.file4dvd.com%2F&r=1" target="_blank">http://ad.yieldmanager.com/<u></u>imp?Z=300x250&s=3007994&T=3&_<u></u>salt=1911752854&B=12&m=2&u=<u></u>http%3A%2F%2Fwww.file4dvd.com%<u></u>2F&r=1</a> HTTP/1.0" 302 712 "<a href="http://ad.yieldmanager.com/st?ad_type=iframe&ad_size=300x250&section=3007994&pub_url=$%7BPUB_URL%7D" target="_blank">http://ad.yieldmanager.com/<u></u>st?ad_type=iframe&ad_size=<u></u>300x250&section=3007994&pub_<u></u>url=${PUB_URL}</a>" "Mozilla/4.0 (compatible; MSIE 5.01; Windows 98)"<br>
<a href="http://www.squeakci.org:80" target="_blank">www.squeakci.org:80</a> 184.22.82.217 - - [23/Oct/2012:07:52:57 +0200] "GET <a href="http://cookex.amp.yahoo.com/v2/cexposer/SIG=13rmsj29b/*http%3A//ad.yieldmanager.com/imp?Z=300x250&s=3007994&T=3&_salt=1911752854&B=12&m=2&u=http%3A%2F%2Fwww.file4dvd.com%2F&r=1" target="_blank">http://cookex.amp.yahoo.com/<u></u>v2/cexposer/SIG=13rmsj29b/*<u></u>http%3A//ad.yieldmanager.com/<u></u>imp?Z=300x250&s=3007994&T=3&_<u></u>salt=1911752854&B=12&m=2&u=<u></u>http%3A%2F%2Fwww.file4dvd.com%<u></u>2F&r=1</a> HTTP/1.0" 302 751 "<a href="http://ad.yieldmanager.com/st?ad_type=iframe&ad_size=300x250&section=3007994&pub_url=$%7BPUB_URL%7D" target="_blank">http://ad.yieldmanager.com/<u></u>st?ad_type=iframe&ad_size=<u></u>300x250&section=3007994&pub_<u></u>url=${PUB_URL}</a>" "Mozilla/4.0 (compatible; MSIE 5.01; Windows 98)"<br>
<a href="http://www.squeakci.org:80" target="_blank">www.squeakci.org:80</a> 92.17.231.188 - - [23/Oct/2012:07:52:59 +0200] "POST /ajaxExecutors HTTP/1.1" 200 545 "<a href="http://squeakci.org/" target="_blank">http://squeakci.org/</a>" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/536.26.14 (KHTML, like Gecko) Version/6.0.1 Safari/536.26.14"<br>
<a href="http://www.squeakci.org:80" target="_blank">www.squeakci.org:80</a> 184.22.82.217 - - [23/Oct/2012:07:52:59 +0200] "GET <a href="http://ad.yieldmanager.com/imp?Z=300x250&s=3007994&T=3&_salt=1911752854&B=12&m=2&u=http%3A%2F%2Fwww.file4dvd.com%2F&r=1&SIG=10vqkkp1b;x-cookie=2awvieq88pp7t&o=3&f=hn" target="_blank">http://ad.yieldmanager.com/<u></u>imp?Z=300x250&s=3007994&T=3&_<u></u>salt=1911752854&B=12&m=2&u=<u></u>http%3A%2F%2Fwww.file4dvd.com%<u></u>2F&r=1&SIG=10vqkkp1b;x-cookie=<u></u>2awvieq88pp7t&o=3&f=hn</a> HTTP/1.0" 200 1806 "<a href="http://ad.yieldmanager.com/st?ad_type=iframe&ad_size=300x250&section=3007994&pub_url=$%7BPUB_URL%7D" target="_blank">http://ad.yieldmanager.com/<u></u>st?ad_type=iframe&ad_size=<u></u>300x250&section=3007994&pub_<u></u>url=${PUB_URL}</a>" "Mozilla/4.0 (compatible; MSIE 5.01; Windows 98)"<br>
<br>
[2]<br>
<br>
92.17.231.188 - - [23/Oct/2012:04:41:01 +0200] "POST /ajaxExecutors HTTP/1.1" 200 545 "<a href="http://squeakci.org/" target="_blank">http://squeakci.org/</a>" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/536.26.14 (KHTML, like Gecko) Version/6.0.1 Safari/536.26.14"<br>
<a href="http://www.squeakci.org:80" target="_blank">www.squeakci.org:80</a> 92.17.231.188 - - [23/Oct/2012:04:41:03 +0200] "POST /ajaxBuildQueue HTTP/1.1" 200 415 "<a href="http://squeakci.org/" target="_blank">http://squeakci.org/</a>" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/536.26.14 (KHTML, like Gecko) Version/6.0.1 Safari/536.26.14"<br>
<a href="http://www.squeakci.org:80" target="_blank">www.squeakci.org:80</a> 92.17.231.188 - - [23/Oct/2012:04:41:06 +0200] "POST /ajaxExecutors HTTP/1.1" 200 545 "<a href="http://squeakci.org/" target="_blank">http://squeakci.org/</a>" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/536.26.14 (KHTML, like Gecko) Version/6.0.1 Safari/536.26.14"<br>
<br>
<br>
[3]<br>
<br>
108.62.111.169 - - [25/Oct/2012:14:30:30 +0200] "GET <a href="http://ad.scanmedios.com/st?ad_type=iframe&ad_size=160x600&section=3522623" target="_blank">http://ad.scanmedios.com/st?<u></u>ad_type=iframe&ad_size=<u></u>160x600&section=3522623</a> HTTP/1.0" 404 558 "<a href="http://classidressing.com/index.php?option=com_mailto&tmpl=component&link=aHR0cDovL2NsYXNzaWRyZXNzaW5nLmNvbS9pbmRleC5waHA/b3B0aW9uPWNvbV9jb250ZW50JnZpZXc9YXJ0aWNsZSZpZD05MzIxOjIwMTItMDEtMjAtMDAtMjAtNDMmY2F0aWQ9NDU6d29tZW4tZmFzaGlvbi10cmVuZHMmSXRlbWlkPTEwMQ==" target="_blank">http://classidressing.com/<u></u>index.php?option=com_mailto&<u></u>tmpl=component&link=<u></u>aHR0cDovL2NsYXNzaWRyZXNzaW5nLm<u></u>NvbS9pbmRleC5waHA/<u></u>b3B0aW9uPWNvbV9jb250ZW50JnZpZX<u></u>c9YXJ0aWNsZSZpZD05MzIxOjIwMTIt<u></u>MDEtMjAtMDAtMjAtNDMmY2F0aWQ9ND<u></u>U6d29tZW4tZmFzaGlvbi10cmVuZHMm<u></u>SXRlbWlkPTEwMQ==</a>" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Win64; x64; .NET CLR 2.0.50727; SLCC1; Media Center PC 5.0; .NET CLR 3.0.04506)"<br>
<a href="http://www.squeakci.org:80" target="_blank">www.squeakci.org:80</a> 50.93.195.16 - - [25/Oct/2012:14:30:30 +0200] "GET <a href="http://ad.yieldmanager.com/st?ad_type=iframe&ad_size=300x250&section=1949015" target="_blank">http://ad.yieldmanager.com/st?<u></u>ad_type=iframe&ad_size=<u></u>300x250&section=1949015</a> HTTP/1.0" 404 558 "<a href="http://www.suddengame.com/index.html" target="_blank">http://www.suddengame.com/<u></u>index.html</a>" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; WOW64; SLCC1; Media Center PC 5.0; .NET CLR 2.0.50727)"<br>
<a href="http://www.squeakci.org:80" target="_blank">www.squeakci.org:80</a> 23.19.67.38 - - [25/Oct/2012:14:30:30 +0200] "GET <a href="http://ad.adserverplus.com/st?ad_type=iframe&ad_size=728x90&section=2898706&pub_url=$%7BPUB_URL%7D" target="_blank">http://ad.adserverplus.com/st?<u></u>ad_type=iframe&ad_size=728x90&<u></u>section=2898706&pub_url=${PUB_<u></u>URL}</a> HTTP/1.0" 404 558 "<a href="http://femaleapple.com/index.php?option=com_content&view=article&id=6299:2012-01-15-02-21-55&catid=42:health-retreats-for-women&Itemid=98" target="_blank">http://femaleapple.com/index.<u></u>php?option=com_content&view=<u></u>article&id=6299:2012-01-15-02-<u></u>21-55&catid=42:health-<u></u>retreats-for-women&Itemid=98</a>" "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9.0.5) Gecko/2008120122 Firefox/3.0.5"<br>
<a href="http://www.squeakci.org:80" target="_blank">www.squeakci.org:80</a> 108.62.178.236 - - [25/Oct/2012:14:30:30 +0200] "GET <a href="http://ad.tagjunction.com/st?ad_type=iframe&ad_size=300x250&section=2933804&pub_url=$%7BPUB_URL%7D" target="_blank">http://ad.tagjunction.com/st?<u></u>ad_type=iframe&ad_size=<u></u>300x250&section=2933804&pub_<u></u>url=${PUB_URL}</a> HTTP/1.0" 404 558 "<a href="http://bestmylive.com/index.php?option=com_mailto&tmpl=component&link=73209a6d834187689d81fdf71892184b784d8229" target="_blank">http://bestmylive.com/index.<u></u>php?option=com_mailto&tmpl=<u></u>component&link=<u></u>73209a6d834187689d81fdf7189218<u></u>4b784d8229</a>" "Mozilla/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 7.11)"<br>
<a href="http://www.squeakci.org:80" target="_blank">www.squeakci.org:80</a> 108.62.75.188 - - [25/Oct/2012:14:30:30 +0200] "GET <a href="http://ad.globe7.com/st?ad_type=iframe&ad_size=160x600&section=3542181&pub_url=$%7BPUB_URL%7D" target="_blank">http://ad.globe7.com/st?ad_<u></u>type=iframe&ad_size=160x600&<u></u>section=3542181&pub_url=${PUB_<u></u>URL}</a> HTTP/1.0" 404 558 "<a href="http://fashionarrow.com/index.php?option=com_mailto&tmpl=component&link=aHR0cDovL2Zhc2hpb25hcnJvdy5jb20vaW5kZXgucGhwP29wdGlvbj1jb21fY29udGVudCZ2aWV3PWFydGljbGUmaWQ9MjY0OTI6MjAxMS0xMi0xOS0xNi00OS0yMSZjYXRpZD00MDpzaG9wLW9ubGluZS1mYXNoaW9uJkl0ZW1pZD05Ng==" target="_blank">http://fashionarrow.com/<u></u>index.php?option=com_mailto&<u></u>tmpl=component&link=<u></u>aHR0cDovL2Zhc2hpb25hcnJvdy5jb2<u></u>0vaW5kZXgucGhwP29wdGlvbj1jb21f<u></u>Y29udGVudCZ2aWV3PWFydGljbGUmaW<u></u>Q9MjY0OTI6MjAxMS0xMi0xOS0xNi00<u></u>OS0yMSZjYXRpZD00MDpzaG9wLW9ubG<u></u>luZS1mYXNoaW9uJkl0ZW1pZD05Ng==</a><u></u>" "Mozilla/5.0 (Windows NT 5.1; U; en; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.53"<br>
<a href="http://www.squeakci.org:80" target="_blank">www.squeakci.org:80</a> 173.208.94.17 - - [25/Oct/2012:14:30:30 +0200] "GET <a href="http://ad.scanmedios.com/st?ad_type=iframe&ad_size=160x600&section=3522623" target="_blank">http://ad.scanmedios.com/st?<u></u>ad_type=iframe&ad_size=<u></u>160x600&section=3522623</a> HTTP/1.0" 404 558 "<a href="http://classidressing.com/index.php?option=com_mailto&tmpl=component&link=aHR0cDovL2NsYXNzaWRyZXNzaW5nLmNvbS9pbmRleC5waHA/b3B0aW9uPWNvbV9jb250ZW50JnZpZXc9YXJ0aWNsZSZpZD05MzQ3OjIwMTItMDEtMjAtMDAtMjAtNTImY2F0aWQ9NDU6d29tZW4tZmFzaGlvbi10cmVuZHMmSXRlbWlkPTEwMQ==" target="_blank">http://classidressing.com/<u></u>index.php?option=com_mailto&<u></u>tmpl=component&link=<u></u>aHR0cDovL2NsYXNzaWRyZXNzaW5nLm<u></u>NvbS9pbmRleC5waHA/<u></u>b3B0aW9uPWNvbV9jb250ZW50JnZpZX<u></u>c9YXJ0aWNsZSZpZD05MzQ3OjIwMTIt<u></u>MDEtMjAtMDAtMjAtNTImY2F0aWQ9ND<u></u>U6d29tZW4tZmFzaGlvbi10cmVuZHMm<u></u>SXRlbWlkPTEwMQ==</a>" "Mozilla/4.0 (compatible; MSIE 6.0; Update a; Win32)"<br>
<a href="http://www.squeakci.org:80" target="_blank">www.squeakci.org:80</a> 142.91.189.9 - - [25/Oct/2012:14:30:30 +0200] "GET <a href="http://ads1.ministerial5.com/creative/2-002134057-00001i;size=4" target="_blank">http://ads1.ministerial5.com/<u></u>creative/2-002134057-00001i;<u></u>size=4</a> HTTP/1.0" 404 558 "<a href="http://travellingonroad.com/index.php?view=article&catid=34%3Acheap-travel&id=3332%3A2012-09-28-09-22-24&format=pdf&option=com_content&Itemid=53" target="_blank">http://travellingonroad.com/<u></u>index.php?view=article&catid=<u></u>34%3Acheap-travel&id=3332%<u></u>3A2012-09-28-09-22-24&format=<u></u>pdf&option=com_content&Itemid=<u></u>53</a>" "Mozilla/5.0 (X11; Linux i686) AppleWebKit/534.35 (KHTML, like Gecko) Ubuntu/10.10 Chromium/13.0.764.0 Chrome/13.0.764.0 Safari/534.35"<br>
<a href="http://www.squeakci.org:80" target="_blank">www.squeakci.org:80</a> 142.91.217.190 - - [25/Oct/2012:14:30:30 +0200] "GET <a href="http://ad.globaltakeoff.net/st?ad_type=iframe&ad_size=300x250&section=2186435&pub_url=$%7BPUB_URL%7D" target="_blank">http://ad.globaltakeoff.net/<u></u>st?ad_type=iframe&ad_size=<u></u>300x250&section=2186435&pub_<u></u>url=${PUB_URL}</a> HTTP/1.0" 404 558 "<a href="http://www.ttfemalehealth.com/index.php?option=com_content&view=article&id=1675:2011-07-11-01-05-13&catid=37:mental-health&Itemid=56" target="_blank">http://www.ttfemalehealth.<u></u>com/index.php?option=com_<u></u>content&view=article&id=1675:<u></u>2011-07-11-01-05-13&catid=37:<u></u>mental-health&Itemid=56</a>" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.8.99 Version/11.10"<br>
<a href="http://www.squeakci.org:80" target="_blank">www.squeakci.org:80</a> 142.91.189.47 - - [25/Oct/2012:14:30:31 +0200] "GET <a href="http://ad.adserverplus.com/st?ad_type=iframe&ad_size=300x250&section=3256421&pub_url=$%7BPUB_URL%7D" target="_blank">http://ad.adserverplus.com/st?<u></u>ad_type=iframe&ad_size=<u></u>300x250&section=3256421&pub_<u></u>url=${PUB_URL}</a> HTTP/1.0" 404 558 "<a href="http://newsja.com/index.php?view=article&catid=35%3Acelebrity&id=8455%3A2012-05-16-13-06-32&tmpl=component&print=1&layout=default&page=&option=com_content&Itemid=54" target="_blank">http://newsja.com/index.php?<u></u>view=article&catid=35%<u></u>3Acelebrity&id=8455%3A2012-05-<u></u>16-13-06-32&tmpl=component&<u></u>print=1&layout=default&page=&<u></u>option=com_content&Itemid=54</a>" "Mozilla/4.76 [en] (X11; U; SunOS 5.7 sun4u)"<br>
<br>
</blockquote>
</div></div></blockquote></div><br>