A few weeks ago I put up a web server that runs as as virtual host handled by Apache 2 on my Ubuntu box. I started having a problem where the web site would get sluggish. Then soon after that it got so sluggish the browser gave up on it saying the web server took too long to respond. At first I thought it was because I was on an AWS EC2 t2.micro. So I upgraded to a t2.medium (2 cores). Things were better at first, and then the problem reappeared. I tried moving to a new hardware instance. Again, good for a while, then soon bad again.
I thought it might be my Node.JS app because it seemed to get better after I restarted the server. But that strategy too after a while no longer helped. I took a look at the Apache 2 virtual hosts log and I was completely shocked. The file was huge, even a single days worth of entries, and my site gets very little traffic. What I saw was a huge number of entries that a little web research told me were proxy entries. I checked my Apache 2 conf file and I didn't see mod_proxy anywhere. But I did find this document with a suggested solution:
That solution said to add the block below to my conf file, to disallow access to my proxy from anyone who is not on the internal sub-nets:
<Proxy *> Order Deny,Allow Deny from all Allow from 192.168.0 </Proxy>
This appears to have helped a lot, at least so far. I guess I was getting so many proxy requests that the overall effect was a virtual DDOS attack. So I have these questions now:
- How can I make absolutely sure my web server can not be used as a proxy?
- Will the attempts eventually die down? I checked the virtual hosts log and now I see a blizzard of 403 errors returned by my server. The activity is not killing my server anymore but instead of the usual 1 second or less response for pages it's about 4 seconds when this activity is taking place. Can I look forward to the proxy abusers giving up after a while?
Finally, if there are any more critical changes I should make please let me know. Things have gotten a lot rougher in web server land since I last did any web work.