Open Proxy

Today I have discovered that TeamSite is running as an open proxy. And some people are already using teamsite as a proxy.

Lovely.

Ok.

According to the following article:
https://support.interwoven.com/kb/kb_show_article2.asp?ArticleID=50628

I can disable proxying. Nope.

Tried all permutations of the given code. Does not work.

My qesution is, I am going to add my own rewrite rules and
what should I allow and what should I disallow?

Solaris 8
TS 6.1

Find more posts tagged with

Comments

Migrateduser

Hello, I'm the developer who maintains iwproxy and iwwebd. I don't understand why the author of the KB article used those mod_rewrite rules. In any case, the support site seems to have mangled the formatting.

In any case, setting

[iwproxy_fullproxy_redirect]

_regex=^http=http://sorry-no-fullproxy-available/

will prevent anyone from making use of this feature.

I'm curious in what way an open HTTP proxy was a problem for you.

--Alan

Valentine

Thanks for the reply. I've found this solution in iw.cfg.example.

I have also tried ProxyRequest off, which works great, but I left it "on".
Any reason that they are on by default?

From the httpd.conf.template
<snip>
ProxyRequests On

<Directory proxy:*>
Order deny,allow
Allow from all
</Directory>

# For fullproxy mode, use iwproxy as our proxy server for all requests
ProxyRemote * http://__IWPROXY_HOST__lithium_IWPROXY_PORT__

# Except for requests that are to bui2 or iwproxy
NoProxy __IWPROXY_HOST__
NoProxy __IWSERVLET_HOST__

# Rewrite the Location header of redirects created by bui2, so that the
# browser comes back to us, instead of trying to contact bui2 directly.
# Note that iwproxy takes care of rewriting redirects created by the
# customer's web server.
ProxyPassReverse / http://__IWSERVLET_HOST__lithium_IWSERVLET_PORT__/
</snip>

ProxyPassReverse could be used w/o "ProxyRequests on" (http://httpd.apache.org/docs/mod/mod_proxy.html)

Our server is open to the internet, and anybody can use it as a proxy server. If it would be on a private network I would not mind proxying.

Why we do not want an open proxy? One word, access to resources based on IP, network.

i.e. use ts server as a proxy server, and you have full access to ieee.org etc etc, sky is the limit.

Edited by Valentine on 03/31/04 07:56 AM (server time).