My Log shows: CONNECT smtp.example.ru:25 HTTP/1.0" 302

[smiddy]

I just started up my own mail server (mailenable) and I'm pretty sure I have that setup right. But, this is coming through my Apache log which I find strange. Any ideas on what it's doing? I only have this one entry, nothing else but regular web accesses.

[jdMorgan]

How does this question differ from that posed here [webmasterworld.com]?

If you're asking about the 302 response as opposed to a 200-OK, then I'd say you've got a RewriteRule, a Redirect directive, or a badly-implemented ErrorDocument directive that is causing a 302 response.

Jim

[extras]

I'm a little curious.

Can you show us the entire line?
Also, can you tell us who is accessing like that?
And you are getting this in your Apache's access.log, right?

[extras]

Additionally, don't you have ErrorDocument directive like this?
ErrorDocument 405 http://example.com/error.html

If so, the 302 redirect comes from the external error doc,
and someone was making strange request to the HTTP server
(hoping to connect to the smtp server?).

Some web servers allow tunnelling connection to smtp:25 via HTTP:80, and the person was checking if it works.
[dsbl.org...]
(Bunch of methods tried by spammers...)

[smiddy]

That pretty much is the entire line.

It should say smtp.rol.ru:25 though. Not sure why it changed in the title.

Sorry jd, it looks different to me and I made some changes that stopped that other error message. Maybe my changes just made this convert to something else. I am not getting any 200 message and this is the only time I have received this one.

I looked in my error log and did find the denial. The redirect must have gotten the guy to the right page?

[Sun Jan 29 07:45:32 2006] [error] [client 61.228.173.13] client denied by server configuration: C:/WebSite/home/

Would a 405 error doc help in this case? I only have a 403 setup at the moment. Must be bad implementation on my part, but hey I'm a hobbiest trying to learn. And you guys are helping and I appreciate that.

[extras]

Oh, I see.
It's just redirected via ErrorDocument 403, because of <LimitExecpt > or something like that.
As you used ecternal redirect for it, it's showing 302 instead of 403.

So, there is nothing strange about it.
You don't need to bother 405.

I'd spend more time in checking other possible vulnerabilities.

[smiddy]

Is there some kind of website checker out there that you can use to test your site for holes?

[jdMorgan]

ErrorDocument syntax:

Use:

ErrorDocument 403 /error.html

and NOT

ErrorDocument 403 http://example.com/error.html

Otherwise, you create a 302 response as documented in Apache's ErrorDocument [httpd.apache.org] description.

Jim