How my Apache server became a malicious free internet proxy

&quot;How my Apache server became a malicious free internet proxy&quot;<p>tl;dr: Negligence, and failing to RTFM.<p>What really horrifies me is the author doesn&#x27;t seem to understand the magnitude of their error. The final quip at the end illustrates this. &quot;Ha! someone searched manslaughter over my proxy! I had a lot of fun reading my open proxy logs...&quot;<p>I wonder how many stolen credit card transactions were done over his proxy, causing headaches for many innocent people? Or worse?

This is a perfect example of why most people should not run their own hardware. Don&#x27;t get me wrong its really fun to build and configure your own server and I openly encourage people to learn but I also remind them that its extremely difficult (for a novice) to do securely.<p>Additionally connecting a misconfigured server to the internet doesn&#x27;t just hurt the server owner but the entire network is affected, as you are providing another piece of hardware that malicious actors can use to execute their attacks.

Honest question from a developer perspective: Why there isn&#x27;t any &quot;best practice&#x2F;hardened by default&quot; wizard-style configuration, something people can do right after they install their OS? E.g.:<p>Welcome to Best Practice Linux. Click Next to continue. Which http server you want (httpd&#x2F;lightttpd&#x2F;...). Click Next to continue. (you get the idea).<p>Something like apt-get but with best-practice defaults.

As someone who&#x27;s used open proxies to get around geo-IP-tracking&#x2F;restrictions&#x2F;censoring, I get the point about excessive bandwidth usage (you can apply per-IP ratelimiting for that), but it does make me a bit sad that open proxies are now considered &quot;malicious&quot;...

So you got to the end solution of... uninstalling fail2ban to fix it? You didn&#x27;t bother to check WHY it was maxing out the cpu?<p>Glad you got the issue resolved though and didn&#x27;t fork over the $10 because you would&#x27;ve just run into the same issue in the future if you didn&#x27;t get to the root cause of it (misconfigured Apache).

Any idea what the actual vulnerability was?

As a long time Apache user I&#x27;ve never understood using its proxy modules for stuff like this. I&#x27;ve always felt like its much cleaner to just use a small daemon process built solely for the task of reverse proxy or balancing. e.g. haproxy, pound, etc.