Re: [squid-users] my squid box spoofed !!

From: Henrik Nordstrom <hno@dont-contact.us>
Date: Tue, 17 May 2005 00:17:01 +0200 (CEST)

On Mon, 16 May 2005, Alex wrote:

> i have a problem with my squid proxy.. suddenly its performance decrease and
> i never get the speed i expect from my squid box, and when i tail to
> access.log i find a weird line of information there,, please find it below :
>
> 1115668842.640 14680 61.224.206.211 TCP_MISS/200 824 CONNECT
> 205.188.156.185:25 - DIRECT/205.188.156.185 -

Please do not remove the default anti-abuse rules found in the distributed
squid.conf.

This is a tell sign that your proxy is configured as an open proxy
allowing anyone anywhere to do anything, and that you are now abused by
spammers to relay spam.

Suggested avion:

Review your http_access rules carefully, and see Squid FAQ Chapter 10
Access Controls.

Regards
Henrik
Received on Mon May 16 2005 - 16:17:03 MDT

This archive was generated by hypermail pre-2.1.9 : Wed Jun 01 2005 - 12:00:03 MDT