How do bots access directories on a server that are not DocumentRoot of public IP address? How do I stop them?
- by tmsimont
I have a local network set up with apache2 and "named" running on OpenSuse 13.1 Linux.
I used the "named" service to use my computer as a domain server. I set up my router to point to ask my computer for domain lookups, so I have a chance to have it rewrite a bunch of domains on my network to its own local IP, 192.168.0.111
This works great.
I use virtual host configuration to allow various domains and subdomains (re-routed to the same IP via named) to pull up different directories in my computer. For example:
<VirtualHost *:80>
ServerName 192.168.0.111
ServerAlias fmb.wa.net
DocumentRoot /home/work/wa.net/fmb
</VirtualHost>
<VirtualHost *:80>
ServerName 192.168.0.111
ServerAlias postrecord.wa.net
DocumentRoot /home/work/wa.net/postrecord
</VirtualHost>
<VirtualHost *:80>
ServerName 192.168.0.111
ServerAlias cvalley.wa.net
DocumentRoot /home/work/wa.net/cvalley_local
</VirtualHost>
This makes it possible for me to hit cvalley.wa.net from any device in my network and get the site that lives in /home/work/wa.net/cvalley_local
I decided to forward port 80 to this computer, so I could share a few development sites with coworkers. I can't control which site they see with the same named service, because they'd have to use my computer as their domain name server...
So I added a line like this:
<VirtualHost *:80>
ServerName 192.168.0.111
ServerAlias MY.IP.XXX.XX
DocumentRoot /home/work/wa.net/cvalley
</VirtualHost>
Where "MY.IP.XXX.XX" is my public IP address.
This works as expected, when you hit my IP address from a public network you see the site that lives in /home/work/wa.net/cvalley.
The point of confusion that I have is that there are public IP addresses in my logs in other sites.
I would have expected it to be impossible to access other sites in my network, unless the public user somehow figured out what I'm calling my ServerAliases, and is mimicing my domain set up...
How can public traffic be hitting my other local sites? How can I recreate this kind of access?
Here are some examples of public IP's hitting my VirtualHost sites:
162.253.66.76 - - [15/Aug/2014:19:20:47 -0600] "GET /xmlrpc.php HTTP/1.0" 404 1004 "-" "-"
162.253.66.74 - - [16/Aug/2014:10:50:28 -0600] "GET / HTTP/1.0" 200 262 "-" "masscan/1.0 (https://github.com/robertdavidgraham/masscan)"
185.4.227.194 - - [16/Aug/2014:11:16:45 -0600] "GET http://24x7-allrequestsallowed.com/?PHPSESSID=1rysxtj500143WQMVT%5E_NAZ%5BQ HTTP/1.1" 200 262 "-" "-"
101.226.254.138 - - [16/Aug/2014:13:32:14 -0600] "HEAD / HTTP/1.0" 200 - "-" "-"
162.253.66.74 - - [16/Aug/2014:14:26:19 -0600] "GET / HTTP/1.0" 200 262 "-" "masscan/1.0 (https://github.com/robertdavidgraham/masscan)"
212.129.2.119 - - [16/Aug/2014:16:00:51 -0600] "HEAD / HTTP/1.0" 200 - "-" "-"
91.240.163.111 - - [16/Aug/2014:18:34:32 -0600] "GET / HTTP/1.0" 200 262 "-" "masscan/1.0 (https://github.com/robertdavidgraham/masscan)"
162.253.66.74 - - [16/Aug/2014:19:02:53 -0600] "GET / HTTP/1.0" 200 262 "-" "masscan/1.0 (https://github.com/robertdavidgraham/masscan)"
122.226.223.69 - - [17/Aug/2014:05:53:09 -0600] "GET http://www.k2proxy.com//hello.html HTTP/1.1" 404 1006 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)"
::1 - - [17/Aug/2014:10:19:26 -0600] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.6 (Linux/SUSE) OpenSSL/1.0.1e PHP/5.4.20 (internal dummy connection)"
162.209.65.196 - - [17/Aug/2014:15:31:53 -0600] "HEAD / HTTP/1.0" 200 - "-" "-"
111.206.199.163 - - [18/Aug/2014:11:12:56 -0600] "HEAD / HTTP/1.0" 200 - "-" "-"
37.187.180.168 - - [18/Aug/2014:15:40:00 -0600] "HEAD / HTTP/1.0" 200 - "-" "-"
62.210.38.226 - - [18/Aug/2014:18:35:16 -0600] "HEAD / HTTP/1.0" 200 - "-" "-"
Is there anything that I can do to reliably deny public access by default, but allow it only in one VirtualHost?
