Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How my Apache server became a malicious free internet proxy

blog.atrament.net

Post reply on HN
Print view View original

21–30 of 42 posts

Re: How my Apache server became a malicious free internet proxy

#21

Post by vog »

bognition wrote: post #2

This is a perfect example of why most people should not run their own hardware. Don't get me wrong its really fun to build and configure your own server and I openly encourage people to learn but I also remind them that its extremely difficult (for a novice) to do securely. Additionally connecting a misconfigured server to the internet doesn't just hurt the server owner but the entire network is affected, as you are…

> should not run their own hardware.

Did you mean "should not run their own dedicated server"? The article doesn't mention anything related to hardware. It could have happened with a rented dedicated server, and even within a virtual machine.

Re: How my Apache server became a malicious free internet proxy

#22

Post by wiradikusuma »

Honest question from a developer perspective: Why there isn't any "best practice/hardened by default" wizard-style configuration, something people can do right after they install their OS? E.g.:

Welcome to Best Practice Linux. Click Next to continue. Which http server you want (httpd/lightttpd/...). Click Next to continue. (you get the idea).

Something like apt-get but with best-practice defaults.

Re: How my Apache server became a malicious free internet proxy

#23

Post by snuxoll »

wiradikusuma wrote: post #22

Honest question from a developer perspective: Why there isn't any "best practice/hardened by default" wizard-style configuration, something people can do right after they install their OS? E.g.: Welcome to Best Practice Linux. Click Next to continue. Which http server you want (httpd/lightttpd/...). Click Next to continue. (you get the idea). Something like apt-get but with best-practice defaults.

Something that proper config management already solves, the default apache module for puppet places sane defaults on everything, from there it's your responsibility to know what you are doing.

Re: How my Apache server became a malicious free internet proxy

#24

Post by SignMeTheHELLUp »

"How my Apache server became a malicious free internet proxy"

tl;dr: Negligence, and failing to RTFM.

What really horrifies me is the author doesn't seem to understand the magnitude of their error. The final quip at the end illustrates this. "Ha! someone searched manslaughter over my proxy! I had a lot of fun reading my open proxy logs..."

I wonder how many stolen credit card transactions were done over his proxy, causing headaches for many innocent people? Or worse?

Re: How my Apache server became a malicious free internet proxy

#25

Post by jrochkind1 »

MariuszGalus wrote: post #17
scintill76 wrote: post #14

Earlier quoted context omitted.

The phrase "[my blog] was being hosted on another port because apache was taking up the internet http port 80" sounds like the reason they were trying to set up a reverse-proxy. Apache docs have an obvious warning about ProxyRequests and security: https://httpd.apache.org/docs/2.2/mod/mod_proxy.html#proxyre... . This config snippet looks like it was copied/modified without understanding: AddDefaultCharset off Order d…

I made the mistake of thinking it was harmless to enable. Also, with the solutions I've found online for enabling 'ghost blog with apache virtualhosts'. I guess someone trolled me.

It's a good idea to always look up the docs on directives in apache configs you are copy-pasting from the internet, to make sure you know what they are doing.

For that matter, this probably applies to just about anything you copy paste on the internet. Understand what you're pasting, look up the docs if you don't or aren't sure or are using something you haven't seen before.

But apache httpd configs can be especially tricky. The accidental open proxy is definitely something that gets lots of people, you are not alone. The apache httpd directive names have a lot of 'legacy' in them, and probably should have been named more clearly in retrospect (i assume the apache httpd forward proxy feature came first, and reverse proxy was only added later; but in 2015 reverse proxy is a lot ore common a thing to want).

(But the solution to an accidental open proxy, if you didn't mean to be forward proxying at all.... is turning off the forward proxy in apache httpd, not other weird workarounds).

Re: How my Apache server became a malicious free internet proxy

#26

Post by newjersey »

wiradikusuma wrote: post #22

Honest question from a developer perspective: Why there isn't any "best practice/hardened by default" wizard-style configuration, something people can do right after they install their OS? E.g.: Welcome to Best Practice Linux. Click Next to continue. Which http server you want (httpd/lightttpd/...). Click Next to continue. (you get the idea). Something like apt-get but with best-practice defaults.

This discussion about otto (from the makers of Vagrant) has some ideas about why people think a one-size-fits-all "default" is a bad/good idea.

https://news.ycombinator.com/item?id=10291778

Re: How my Apache server became a malicious free internet proxy

#27

Post by MariuszGalus »

SignMeTheHELLUp wrote: post #24

"How my Apache server became a malicious free internet proxy" tl;dr: Negligence, and failing to RTFM. What really horrifies me is the author doesn't seem to understand the magnitude of their error. The final quip at the end illustrates this. "Ha! someone searched manslaughter over my proxy! I had a lot of fun reading my open proxy logs..." I wonder how many stolen credit card transactions were done over his proxy, ca…

(:

Re: How my Apache server became a malicious free internet proxy

#28

Post by bryogenic »

wiradikusuma wrote: post #22

Honest question from a developer perspective: Why there isn't any "best practice/hardened by default" wizard-style configuration, something people can do right after they install their OS? E.g.: Welcome to Best Practice Linux. Click Next to continue. Which http server you want (httpd/lightttpd/...). Click Next to continue. (you get the idea). Something like apt-get but with best-practice defaults.

Something link this might be a start:

https://github.com/hardening-io/ansible-os-hardening

Re: How my Apache server became a malicious free internet proxy

#29

Post by rtkwe »

nostalgiac wrote: post #8

So you got to the end solution of... uninstalling fail2ban to fix it? You didn't bother to check WHY it was maxing out the cpu? Glad you got the issue resolved though and didn't fork over the $10 because you would've just run into the same issue in the future if you didn't get to the root cause of it (misconfigured Apache).

At this point fail2ban wasn't really needed anymore since the author installed it to stop the people using the server as an open proxy. After they solved the proxy issue fail2ban was just causing problems and wasn't needed.

Re: How my Apache server became a malicious free internet proxy

#30

Post by AgentME »

wiradikusuma wrote: post #22

Honest question from a developer perspective: Why there isn't any "best practice/hardened by default" wizard-style configuration, something people can do right after they install their OS? E.g.: Welcome to Best Practice Linux. Click Next to continue. Which http server you want (httpd/lightttpd/...). Click Next to continue. (you get the idea). Something like apt-get but with best-practice defaults.

Apache doesn't default to acting as an open proxy. It already has safe defaults! He specifically configured it this way.
Post reply on HN