I'm so grateful for Drbyte's fast answer, sure I will buy Zen cart team a cup of coffee, to show my respect for your precious time and attention.
After one day's googling the web I came to understand the access log and the cracker's purpose, but I still have not implemented the .htaccess method which I found on the web, please zen cart experts' here give me your precious opinions! (I only have access to .htaccess, no access to httpd.conf); also I'm still not sure whether my server is an open proxy server or not, what settings should I request my server company to check, so I can come a conclusion.
This article stated this problem very clearly.
https://wiki.apache.org/httpd/ProxyAbuse
what are the hacker are trying to do? what do these access logs means?
These external/foreign domain name indicates that hackers/crackers are probing sites for open proxy servers, so they can use it to browse/abuse other sites.
http://security.stackexchange.com/questions/41078/url-from-another-domain-in-my-access-log
Here this people also got weird URLs in his access log:
95.47.119.124 - - [19/Aug/2013:11:30:31 +0000] "GET http://server7.cyberpods.net/azenv.php HTTP/1.1" 404 3080 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.28) Gecko/20120306 Firefox/3.6.28 (.NET CLR 3.5.30729)"
223.220.68.129 - - [21/Aug/2013:00:55:46 +0000] "GET http://www.##########.com/ HTTP/1.1" 404 3080 "http://www.##########.com/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)"
Fortunately in this case the server fed back 404 page not found response, so this server is correctly configured and safe.
http://serverfault.com/questions/622334/apache-server-access-log-shows-another-domains-request-and-got-redirected
This people also got other domain' requests, but his server fed back 301 response, because he had mod_rewrite module enabled and is using .htaccess redirecting other things.
http://serverfault.com/questions/149982/why-are-external-domains-appearing-in-my-apache-logs
This people got external domain names in his access logs, and here the expert said "being a public proxy without realising are quite slim, especially if you're serving your website directly from your server without any proxying at all."
How external domain name got into access logs?
http://serverfault.com/questions/149982/why-are-external-domains-appearing-in-my-apache-logs
"Anyone can connect to a webserver and request any url they wish from any host. It'll then turn up in your log. this example will get you an entry in your apache log for www.asdfasdfasdfsdafsdf.com"
$ nc www.whateveryourdomainishere.com 80
GET / HTTP/1.1
host: www.asdfasdfasdfsdafsdf.com
are these entries safe? should I worry about this?
In my case I got all kinds of HTTP response: 200, 302, 401, 404, 500.
401/404/500 should be safe; for 302 I didn't find an answer; but for 200 it is more complicated:
normally, as long as the proxy is disabled, Apache would respond to such requests with status code 405 (Method not allowed). The fact that a success 200 status code is returned indicates that a third-party module is processing the CONNECT requests. The most likely culprit is php, which in its default configuration will accept all methods and treat them identically.
That 200 status code indicates that Apache successfully sent a response to the client, but not necessarily that the response was retrieved from the foreign website. Even when proxying is turned off, Apache will accept requests that look like proxy requests and serve the homepage content from your default (virtual) host, since the hostname probably doesn't match a name for your site.
The size of the response can be compared to your homepage to confirm that the response was served locally and no proxying was involved.
https://wiki.apache.org/httpd/ProxyAbuse
what we can do to stop this?
- block these proxies requests in .htaccess (I have not implemented it yet, I'd like hear opinions here)
https://www.webmasterworld.com/forum92/4406.htm
# BLOCK attempts to use our server as a proxy, but allow absolute URIs
RewriteCond %{THE_REQUEST} ^[A-Z]+\ /?http:// [NC]
RewriteCond %{THE_REQUEST} !^[A-Z]+\ /?http://([^.]+\.)?yourdomain\.com
RewriteRule .* - [F]
for https sites (If I understand correct there):
# BLOCK attempts to use our server as a proxy, but allow absolute URIs
RewriteCond %{THE_REQUEST} ^[A-Z]+\ /?https?:// [NC]
RewriteCond %{THE_REQUEST} !^[A-Z]+\ /?https?://([^.]+\.)?yourdomain\.com
RewriteRule .* - [F]
- We can disable proxy in Apache by disabling proxying altogether by using the --disable-proxy option when building Apache, or by ensuring that the -D PROXY option is not used when starting Apache,
http://www.tuxradar.com/answers/362
- block or drop these IP addresses with iptables
http://www.tuxradar.com/answers/362
-
disable mod_proxy by commenting out its LoadModule line or setting ProxyRequests off in httpd.conf. Remember that disabling ProxyRequests does not prevent you from using a reverse proxy with the ProxyPass directive.
http://www.tuxradar.com/answers/362
-
if you don't want your server response to requests for random hostnames, deny them this way:
https://wiki.apache.org/httpd/ProxyAbuse
NameVirtualHost *:80
<VirtualHost *:80>
ServerName default.only
<Location />
Order allow,deny
Deny from all
</Location>
</VirtualHost>
<VirtualHost *:80>
ServerName realhost1.example.com
ServerAlias alias1.example.com alias2.example.com
DocumentRoot /path/to/site1
</VirtualHost>
- if you want to drop these requests and send no response, install third party module mod_security
https://wiki.apache.org/httpd/ProxyAbuse
how to prove that the open proxy function has been disabled on server?
-
Configure your browser to use your web server as its default proxy server and then try to request foreign sites. You should get only your own website content back in reply.
-
Manually construct requests using telnet, then press enter twice. If your server is properly configured, you should receive content from your own site and not Yahoo
telnet yoursite.example.com 80
GET http://www.yahoo.com/ HTTP/1.1
Host: www.yahoo.com
- If the size of the returned page is always the same, irrespective of the URL requested, Apache is returning a local page - probably an error message from the small size. You should be able to tell from the IP addresses and frequency of these log entries whether this is a single, misconfigured computer or scripted attempts to find suitable servers to exploit.
http://www.tuxradar.com/answers/362
