How do I stop an Open Proxy

Question

I have a G5 server running OS X 10.4.8 hosting a couple of web sites.
From evidence in my log files I appear to be running a “partial” Open Proxy and would like to know how to stop this.
This is my setup:
* Enable Proxy in unchecked (although Control Access to Proxy is checked). Note, until about 3 months ago this was checked by accident.
* All sites have Performance Cache unchecked.
* I have ports 80 (http), 443 (https) and 8080 (https) open (I need 8080 for a second digital certificate).
* I'm running PHP and MySQL.
I have tested for open proxy (via http://www.euirc.net/en/proxycheck.php) and it reports I’m not running a proxy.
HOWEVER, if I check my web logs I can see successful accesses (200) from external IP addresses:
xxx.xxx.xxx.xxx - - [03/Dec/2006:10:26:45 +0000] "GET http://www.yahoo.com/ HTTP/1.0" 200 90 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
Fortunately, other accesses appear to get rejected with 404:
xxx.xxx.xxx.xxx - - [03/Dec/2006:05:00:05 +0000] "GET http://www.peopower.com/server/Headers.shtml HTTP/1.1" 404 426 "http://www.yahoo.com" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050511"
xxx.xxx.xxx.xxx - - [03/Dec/2006:10:49:50 +0000] "POST http://toscontrol.com/CheckProxy.php HTTP/1.0" 404 406 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
xxx.xxx.xxx.xxx - - [03/Dec/2006:10:51:33 +0000] "GET http://www.hide-my-ip.com/xprox.cgi?ip=74.52.29.146 HTTP/1.1" 404 417 "-" "Mozilla/5.0 (745222)"
Plus, I’ve done a Google search on my IP address and it appears in various proxy forums !
These are my questions:
* Should I be worried (I think yes as I’m concerned they my hide behind my IP address, which could then become black-listed).
* How do I close my open proxy ?
* How can I be certain that I'm not running an open proxy ?
Thanks in advance,
john
G5 Server   Mac OS X (10.4.8)   PHP, MySQL

Answer 1

Thanks Roger for the reply.
This is a real puzzle ! I wonder if these pages are still sitting in my cache left over from when I was (unintentionally) running an open proxy.
I’ve just done a quick analysis of last night’s logs and, yet again, I have entries which reference off to other sites and return 200. For example, www.yahoo.com, www.sun.com, www.qq.com. plus some explicit IP address with port mumbers. There’s about 200 in total from about 20 IP address. From the timings they look like robots. Example,
xxx.xxx.xxx.xxx - - [03/Dec/2006:20:29:02 +0000] "GET http://www.qq.com/ HTTP/1.0" 200 90 "-" "-"
xxx.xxx.xxx.xxx - - [04/Dec/2006:16:50:33 +0000] "HEAD http://www.sun.com/ HTTP/1.1" 200 0 "-" "Mozilla/5.0 ( Windows; U; Windows 98; DigiExt )"
xxx.xxx.xxx.xxx - - [04/Dec/2006:17:25:41 +0000] "GET http://xxx.xxx.xxx.xxx:46449/ HTTP/1.0" 200 90 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
But equally, there are far more (thousands) where 404 has been returned !
xxx.xxx.xxx.xxx - - [04/Dec/2006:19:34:16 +0000] "POST http://www.carhiredeal.com/hitTestAdv.aspx HTTP/1.1" 404 424 "http://www.valuecarrentals.com/" "-"
xxx.xxx.xxx.xxx - - [04/Dec/2006:19:34:30 +0000] "POST http://ipexposed.com/pr/pst.php HTTP/1.1" 404 413 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)"
xxx.xxx.xxx.xxx - - [04/Dec/2006:19:38:43 +0000] "GET http://clickingagent.com/proxycheck.php?ip=xxx.xxx.xxx.xxx&port=80&loc= HTTP/1.0" 404 409 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
My current thinking is to stop the IP addresses at the firewall, but this doesn't address the real issue as to why is 200 being returned for some sites ?
john