On Tue, 2006-06-27 at 15:19 +0530, Ankush Grover wrote:
I am running Apache on FC3. For last few days I am regulary seeing
some Connection attempts using mod_proxy through the below listed
addresses in the logs.
output of logwatch
124.8.0.88 -> smtp.pchome.com.tw:25 : 2 Time(s)
124.8.21.214 -> smtp.pchome.com.tw:25 : 2 Time(s)
124.8.3.72 -> smtp.pchome.com.tw:25 : 8 Time(s)
220.132.20.167 -> smtp.pchome.com.tw:25 : 2 Time(s)
I can block these addresses through IPtables what I am interested in
knowing is that should I disable mod_proxy module in apache. Well I
don't know much about mod_proxy I am using squid as proxy server for
my domain. Disabling mod_proxy will have any impact on the performance
of the squid.
If you're not using Apache to proxy (and you should know if you are, as
you have to specially configure it to do so), then you can just not load
in the module.
You can set up Apache to cache (a different function than proxying) some
of its output. That can be handy if your server dynamically generates
pages for each request, but the generated page is going to be the same
most of the time. But that's a different configuration, yet again.
Go through your configuration file, and try disabling modules you're not
using (read the manual, as you go along). You should make your server a
bit less vulnerable, and perhaps faster to start up.
I just went through doing that the other day, disabling a few modules
that I don't use. I'm sure that Apache starts up quicker on that box,
now. The box is a bit slow, so every little bit helps.
Only the other day I saw my first attempt at a port 25 connection in the
logs. Prior to that it was mostly just straight connection attempts
(about one every half hour), with an occasional attempt to do something
else.
--
(Currently running FC4, occasionally trying FC5.)
Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.