This Space Intentionally Left Blank

12 Fructidor CCXI (August 29, 2003)

(Ramblings) Best. Denied Connection. Ever. 

195.77.169.3 - - [29/Aug/2003:17:24:31 -0300] "CONNECT 1.3.3.7:1337 HTTP/1.0" 400 449 "-" "-"

While I get annoyed at people trying to probe my machine for proxies, the fact that this guy is using an IP of 1.3.3.7 (and corresponding port) amuses me to no end.

Update: I got bored and did a bit of searching on it.  As I mentioned previously, the CONNECT bit means that someone's trying to find an open proxy on my machine.  Why exactly it's being done seems to be up in the air at the moment, but some sources reckon it's the same people (using compromised machines) that used to try and tunnel through to port 25 on a bunch of mail servers.  The thing with CONNECT being that the address doesn't have to exist, it's the status code (in this case 400 - Bad Request) that's important.

Posted by g026r at 17:54
Comments

Hi,
I got the same entry in my Apache logs. It returned a '200' - not a 404 - error.

What do I have to change in the Apache config file to stop tunneling?

Thanks,
Marc

Posted by Marc at 4 Vendémiaire CCXII 08:17 (2003/09/25)

Right, I was gone for a week so I just spotted this now.

I'm returning a 400 as I blocked anyone without a user agent specified using mod_security.
As I doubt you're using that (it can be a bit of a pain to set up) there's a bunch of things you can do:

  1. If you don't need to use a proxy at all you can comment out the line that loads mod_proxy in your httpd.conf file.
  2. If you somehow have mod_proxy built in then you can use the ProxyRequests Off command in your httpd.conf file to turn off your proxy.
  3. If you need to use the proxy server for some reason then it gets trickier. The easiest way is to use the ProxyBlock directive to block access to that IP. You'd use something like ProxyBlock 1.3.3.7 to block access to that IP, so it would return a different status code instead of 200. This only works until whomever is doing it changes the IP they're attempting to connect to though.

More info on mod_proxy and its options is here, as I can only give a wee bit of help on it.

Feel free to post with any more questions though and I'll help the best I can.

Siteicon Posted by g026r at 8 Vendémiaire CCXII 22:45 (2003/09/29)
Post a comment







Past Entries

Past Entries