Heya, I've been using elog for a year or so, with a proxy through Apache,
but recently I've ran into some trouble with my Apache config, where
spammers were using my incorrectly configured proxy to send spam.
I have
some requests for the Administrator's Guide: "Running elogd under Apache".
I'm hoping a few little notes will save others the trouble I've gone
through. Neither of these are any fault of elog's or Apache's, but of my own
ignorance. (I am using elog 2.3.9, and Apache 2.something, if that matters)
1) When doing "ProxyPass ..." when setting up elog under Apache, do NOT put
"ProxyRequests On". This is not needed, if it is enabled and not set up
correctly, it allows spammers to send spam via Apache's proxy. More
information on this is here: http://www.apacheweek.com/issues/03-07-25,
about halfway down the page, under "Spammers use open Apache proxies"
Even though it doesn't mention ProxyRequests in the guide, I think there
should be a little side note mentioning that "ProxyRequests On" is NOT
needed, because I put it in, thinking it was - I am probably not the only one.
2) I have found that mod_proxy_http.c must be loaded in addition to
mod_proxy.c and mod_alias.c for the proxy to work, otherwise I get a 403
error. I think this should be mentioned as well. |