question on httpd log entry

Randy Yates · External Since: Sep 07, 2006 Posts: 159

I'm running apache on FC6. I've got the following log entry:

218.59.121.57 - - [08/Aug/2007:13:30:08 -0400] "GET http://www.filesdatabase.com/azenv.php HTTP/1.1" 404 293 "http://www.filesdatabase.com/azenv.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"

What does it mean? How can an http client issue a "GET" to a server
for a file that is on some other server? What what are the response
codes "404 293"? I figure 404 is not found, but what is 293?
--
% Randy Yates % "I met someone who looks alot like you,
%% Fuquay-Varina, NC % she does the things you do,
%%% 919-577-9882 % but she is an IBM."
%%%% <yates RemoveThis @ieee.org> % 'Yours Truly, 2095', *Time*, ELO
http://home.earthlink.net/~yatescr

Jacob Sparre Andersen · External Since: Jul 04, 2004 Posts: 35

Randy Yates <yates RemoveThis @ieee.org> writes:

> I'm running apache on FC6. I've got the following log entry:
>
> 218.59.121.57 - - [08/Aug/2007:13:30:08 -0400] "GET http://www.filesdatabase.com/azenv.php HTTP/1.1" 404 293 "http://www.filesdatabase.com/azenv.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
>
> What does it mean? How can an http client issue a "GET" to a server
> for a file that is on some other server?

It might attempt to use your server as a proxy.

> What what are the response codes "404 293"? I figure 404 is not
> found, but what is 293?

Most likely the number of bytes used to tell the client that the
attempt didn't work.

The format of Apache log files is configurable, but your line looks
like the default configuration for the access log.

Greetings,

Jacob
--
»By becoming continuous, war has fundamentally changed its character.
In past ages, a war, almost by definition, was something that sooner
or later came to an end, usually in unmistakable victory or defeat.«
-- Nineteen Eighty-Four, George Orwell
»I don't think you can win [the war on terror].« -- George W. Bush

Randy Yates · External Since: Sep 07, 2006 Posts: 159

Jacob Sparre Andersen <sparre.TakeThisOut@nbi.dk> writes:

> Randy Yates <yates.TakeThisOut@ieee.org> writes:
>
>> I'm running apache on FC6. I've got the following log entry:
>>
>> 218.59.121.57 - - [08/Aug/2007:13:30:08 -0400] "GET http://www.filesdatabase.com/azenv.php HTTP/1.1" 404 293 "http://www.filesdatabase.com/azenv.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
>>
>> What does it mean? How can an http client issue a "GET" to a server
>> for a file that is on some other server?
>
> It might attempt to use your server as a proxy.
>
>> What what are the response codes "404 293"? I figure 404 is not
>> found, but what is 293?
>
> Most likely the number of bytes used to tell the client that the
> attempt didn't work.
>
> The format of Apache log files is configurable, but your line looks
> like the default configuration for the access log.
>
> Greetings,
>
> Jacob

Thanks for the info, Jacob.

So I take it that this is a type of attack? The idea is that,
if proxy serving is enabled, someone could have my server
execute, e.g., their PHP code? Blah!

So in order to prevent this type of attack, I should
leave proxy serving disabled by leaving the following
lines in httpd.conf commented out:

# Proxy Server directives. Uncomment the following lines to
# enable the proxy server:
#
#<IfModule mod_proxy.c>
#ProxyRequests On
#
#<Proxy *>
# Order deny,allow
# Deny from all
# Allow from .example.com
#</Proxy>

?

Thanks again for the info.
--
% Randy Yates % "My Shangri-la has gone away, fading like
%% Fuquay-Varina, NC % the Beatles on 'Hey Jude'"
%%% 919-577-9882 %
%%%% <yates.TakeThisOut@ieee.org> % 'Shangri-La', *A New World Record*, ELO
http://home.earthlink.net/~yatescr