From owner-freebsd-questions@FreeBSD.ORG  Tue Jun 19 11:32:17 2007
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
X-Original-To: freebsd-questions@freebsd.org
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id 3268C16A46B
	for <freebsd-questions@freebsd.org>;
	Tue, 19 Jun 2007 11:32:17 +0000 (UTC)
	(envelope-from bob@a1poweruser.com)
Received: from mta11.adelphia.net (mta11.adelphia.net [68.168.78.205])
	by mx1.freebsd.org (Postfix) with ESMTP id EEB8213C448
	for <freebsd-questions@freebsd.org>;
	Tue, 19 Jun 2007 11:32:16 +0000 (UTC)
	(envelope-from bob@a1poweruser.com)
Received: from laptop ([76.190.225.105]) by mta11.adelphia.net
	(InterMail vM.6.01.05.02 201-2131-123-102-20050715) with SMTP
	id <20070619113216.UGQ3934.mta11.adelphia.net@laptop>;
	Tue, 19 Jun 2007 07:32:16 -0400
From: "Bob" <bob@a1poweruser.com>
To: "Norberto Meijome" <freebsd@meijome.net>
Date: Tue, 19 Jun 2007 07:32:15 -0400
Message-ID: <NBECLJEKGLBKHHFFANMBMEMOCDAA.bob@a1poweruser.com>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0)
Importance: Normal
In-Reply-To: <20070614024343.10ff6632@localhost>
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028
Cc: Ian Smith <smithi@nimnet.asn.au>, freebsd-questions@freebsd.org
Subject: RE: Apache access log shows these attack requests
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: bob@a1poweruser.com
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 19 Jun 2007 11:32:17 -0000


The replies to my post came back saying that apache defaults to denying
CONNECT requests which I was not able to verify. That mod_proxy was causing
it. I have mod-proxy commented out.
That the CONNECT request is some how being spoofed through php  which I was
not able to verify.
My reading of php5 says it accepts all valid methods that apache hands it.
To me this indicates that apache is not denying CONNECT requests by default.
Reading a book I have titled 'Maximum Apache Security' it said to gain
explicit control over the "Methods" use the <Limit> or <LimitExcept>
declaratives with the 'Require valid-user' in the default  <Directory />
definition in the http-conf file.

So in apache http-conf around line 340 I added the <LimitExcept GET POST>
Declarative like this to the default directory definition so it looks like
this.

<Directory />
   Options FollowSymLinks
   AllowOverride None
   Order allow,deny
   Allow from all
   <LimitExcept GET POST>
      Require valid-user
   </LimitExcept>
</Directory>

Now the access log shows this

61.228.120.228 - - [17/Jun/2007:22:42:49 -0400] "CONNECT 66.196.97.250:25
HTTP/1.0" 500 602 "-" "-"

And the error.log shows this

[Sun Jun 17 22:42:49 2007] [crit] [client 61.228.120.228] configuration
error:  couldn't perform authentication. AuthType not set!: /


As you can see the CONNECT request is now being denied with a 500.
The CONNECT requests have been stopped from attacking others.

I post this solution so others can find it in the questions archives.