Tag Info

New answers tagged

0

Yes, it should be removed on a production system - unless (of course) you are actually using it. If you're not sure, it probably means that you're not using it. Here is why: With this configuration, cgi-bin/ points to /usr/lib/cgi-bin and whatever is in there can be executed. It's a system directory, so what's in there usually depends on what you've ...


0

I figured it out! Rather than including the username:password as part of the URI scheme, the Authorization header needs to be set independently. The following solution works completely within a .htaccess file, which is important since OS X periodically blows away settings inside VirtualHost sites: SetEnvIf Request_URI ^/download/* ADD_COUCH_BASIC_AUTH ...


0

You cannot reliably detect if a user is using VPN. There are many different VPN solutions, and regardless of your detection method a new VPN solution could come along and defeat your detection method. That said, some VPN solutions can be detected. The first signal I would look for is the PMTU. Because the VPN adds additional headers, they have to either ...


0

Another alternative could be doing it via CRON. Here is how I do; #!/bin/bash for file in /var/www/*/logs/*.log; do # zip and truncate file (dont remove cos apache cannot write on it unless restarted) zip $(dirname $file)/$(date +"%Y-%m-%d")-$(basename $file).zip $file && truncate -s 0 $file done This script will produce a zipped log file like ...


0

You cannot really redirect without changing an address displayed in bar. If you want a similar effect, you have at least two options: reverse proxy (mod_proxy_http) - possibly transparent to user; HTML frame - obsolete, easy to detect and prone to fail with modern browsers. Edit #1: For proxy solution, you need to place the directives below in global or ...


0

I don't see any benefit from using multiple tiers load balancer. Ajp is binary protocol much faster than http, so if you use Haproxy in front in tcp mode (faster than http) to Apache and then mod_jk between Apache and Jboss you will notice some boost. comparing to Haproxy http mode to Jboss.


0

I'm pretty sure there is no already-implemented way to return a list of existing actions, scripts, etc your handler could map requests to. It might be possible to write an apache module that could return such information, but it'd take a bit of exploration of the apache code to even understand what's possible there.


1

You can deploy your Larave 5 application on Ubuntu. you can use php,apache composer also. PHP artisan serve is used for running development server. The purpose is to check if all functionality is working fine or not. It is not recommended to use this at deployment. you have to follow the commands specified below. 1. Install apache server. 2. Install PHP ...


2

I had this issue behind AWS Elastic Load Balancer. Health checks generated an awful amount of 408 responses in the log. The only solution that worked for me was to have Load Balancer's Idle Timeout setting lower than its Health Check's Response Timeout.


0

You'll want to have your proxy set a header like X-Forwarded-For (which might already be set, depending on what's doing the proxying), then use it for the access control check instead, as covered here. Something like this.. Require valid-user SetEnvIf X-Forwarded-For 10\.0\.\d+\.\d+$ proxy_env Order allow,deny Allow from env=proxy_env Satisfy any


0

Some rewrite magic did the trick. However, now I have an issue that omitting a trailing slash causes it to not find the directory and return the rewritten path to the browser... RewriteEngine On RewriteCond $1 ^(?!\/repostyle) RewriteRule ^(.+) /svn$1 [PT] <Location /svn> DAV svn SVNListParentPath on SVNParentPath /mnt/repos/svn SVNIndexXSLT ...


0

Take a look here, one of these should solve your problem, http://stackoverflow.com/questions/8896644/request-entity-too-large Most likely you need to change the SSL buffer size in your apache config file. SSLRenegBufferSize 10486000 The name and location of the conf file is different depending on distributions. In Debian you find the conf file here, ...


-1

On CentOS you'd run /usr/local/apache/bin/apachectl fullstatus


0

But why you still use "AuthUserFile"? this works for me: AuthType Basic AuthName "Some name" Require ldap-group <snip> SSLOptions +FakeBasicAuth AuthBasicProvider ldap AuthLDAPBindDN uid=<snip> AuthLDAPBindPassword <snip> AuthLDAPURL ...


0

OK, +1 for the internet, -1 for Apple. The culprit was mod_spdy on Apache 2.2. I don't know what or how or why, but disabling mod_spdy resolved the issue. I'm not too happy to live it like this, but I don't have a choice for the time being.


0

Can you try this configuration on your server? <VirtualHost *:443> ServerName www.example.com ServerAlias *.example.com Redirect 301 / example.com/ DocumentRoot /var/www/example ... #options and allow/deny for directories ... #logging settings SSLEngine on ... #ssl settings </VirtualHost> You can exclude the last ...


1

Lots of good suggestions here already. There's stuff that's been missed in the discussion so far though. Pay attention to processes outside of those run as part of serving web pages. i.e. make sure that all your cron jobs that touch untrusted data are running as the appropriate user and in the appropriate jail, whether those jobs are defined by the user ...


0

Apache 2.4.7: Header setifempty Access-Control-Allow-Origin "*" Apache 2.2.4 below Header append Access-Control-Allow-Origin "" Header edit Access-Control-Allow-Origin "^$" "*"


0

Apache 2.4.7 Header setifempty Access-Control-Allow-Origin "*" Apache 2.2.4 below Header append Access-Control-Allow-Origin "" Header edit Access-Control-Allow-Origin "^$" "*"


0

If rewrite.conf is being included in a <Directory> tag or has its rewrites contained within a <Directory> tag, try moving it out of that and just residing at the VirtualHost level.


0

The Mozilla wiki has an excellent article on configuring the ciphers used by Apache. They provide example strings for three different levels of compatibility depending on your needs. You should also check that your version of Apache supports elliptic curve crypto. You can find more detail here. Lastly, try using SSL Labs to check your site for cipher ...


0

These requests usually don't slow down your site, unless you are being attacked/DDoS. You may want to consider Fail2ban. Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc. Generally Fail2Ban is then used to update firewall rules to reject the IP ...


1

First thing I don't see is process management so one process cannot starve another process of CPU or RAM (or I/O for that matter, though your filesystem may be architected to prevent that). One major advantage of a "containers" approach to your PHP instances vs. trying to run them all on one "OS" image is that you can restrict resource utilization better ...


0

You need a DNS record www.testsite.org in the public DNS pointing (directly or indirectly) to your server's IP address in order to make your server reachable from the Internet by the name www.testsite.org. You can check whether such a DNS record exists and points to the correct server using the Linux host(1) command, eg. "host www.testsite.org". If the DNS ...


0

Problem solved! Seems there was more Listen params in ssl.conf, commented out all except Listen 443, everything seems to be working fine now.


0

Edit: I re-read the question. Grep your httpd.conf for Listen and Include directives. If you don't find any extra Listen directives in the httpd.conf, repeat the process on any files or directories referenced by Include directives. Something is telling Apache to continue listening on port 80, you just need to find which file/line is doing it. Original: ...


1

Check ForceType, You have examples of usage in the manual page. Wrap the directive in <FilesMatch REGEX> block, with regular expression matching ie. files without a dot (thus not having an extension). Anyway, consider leaving PHP files with proper extensions and using mod_rewrite for better looking URIs.


0

I have managed to get this working. The last change I made was to add ProxyRequests Off and ProxyPreserveHost On to the virtual host configuration. Additionally and prior to making the Proxyrequests and ProxyPreserveHost directives, I moved the ..... to the virtual host and also added location directives from (Pro Webmasters - How do I set up a “gateway” ...


0

You have three approach at disposition, basically: use lighttpd instead of Apache, as it has integrated bandwidth control and management use one of the various (non-official) Apache modules availables, as mod_qos, mod_cband, mod_limitipconn, ecc. use tc and/or netfilter to create queues and mark packets based on source ports (which will be more or less ...


1

I'd suggest next time you start it, start an strace running so that after it dies you can investigate what calls were happening last before it failed. You can use the following command after you start it to make sure you attach to the master process and all its children and any new ones that get forked. pidlist=''; for pid in `ps ax | grep httpd | awk ...


0

After fighting with this for a while, I finally just moved /etc/httpd/conf.d/05-foreman.conf to /etc/httpd/conf.d/05-foreman.conf-noload to keep the httpd service from even starting foreman on port 80. I access the webapp via 443 all the time anyway. Nothing appears broken. This appears to give back directory listings to port 80 so I can actually use the ...


0

I think you are missing apache alias directive Alias /foreman /usr/share/foreman/public <Directory "/usr/share/foreman/public"> Options FollowSymLinks Indexes AllowOverride None Order allow,deny Allow from all </Directory> After that reload apache service or restart it or if you are running foreman with passenger, you need to ...


1

On Tomcat's web you have a HowTo explaining how to use apache to connect to Tomcat, so users will connect to apache (without need of specify a port) then apache will pass requests to Tomcat. You can also user ProxyPass on your apache and just forward requests to Tomcat, you only need to search on internet next keywords apache tomcat proxypass


0

The error is telling you that DocumentRoot must be a directory. DocumentRoot in your config is "/var/www/html/bugzilla". Does that path exist? Is it a file or a directory? If you have installed Bugzilla directly in /var/www/html, then /var/www/html/bugzilla will not exist. If this is a new installation, you would do well to install 5.0 following the ...


1

First of all you need to make sure the SSL mod is enabled a2enmod ssl then you need to change your config to something like this: <VirtualHost *:443> SSLEngine On SSLCertificateFile /etc/ssl/localcerts/www.test-site.com.crt SSLCertificateKeyFile /etc/ssl/localcerts/www.test-site.com.key SSLCertificateChainFile ...


0

Alright, so here's the solution I ended up going with, which works nicely. For the sake of a thorough answer, I will recap some quick details. Servers: ServerA - ubuntu 12.04 - internal static ip of 192.168.1.230 ServerB - ubuntu 14.04 - internal static ip of 192.168.1.235 I have a website on each server, one on 12.04 (with an older php install) that i ...


-3

The answer to the first question really depends on how CPU intensive the software is going to be, but should be able to cope with 100 clients per hour RAID is slowly going obsolete, however unless you are deploying larger scale NAS/SAN with this it will work fine. As for which type of RAID, with 2 disks you are pretty much only able to do 0 and 1, so do 1. ...


0

Yes, this is normal - by default all websites sharing an IP address will be pulled up if going to https://anydomainthatsharesthatip.com. The reason why is that SSL is at a level before HTTP header communication so all Apache has to go on at that stage of the request is the IP address and port being requested (i.e. it hasn't received the HTTP Host: header ...


0

They're probably POSTing large amounts of data. It doesn't matter that the URL doesn't exist, that only gets checked after the request incuding POST data has been made. You could forbid POST requests altogether in the default vhost; enable the rewrite module and put this in the default virtual host definition: RewriteCond %{REQUEST_METHOD} POST RewriteRule ...


1

I think you can accomplish this if you have mod_authz_host and mod_rewrite. Basically set an environment variable if the URL matches /exams and look for that and if it's set allow access. See the example below. In this example you would not have the additional <Location> tag. SetEnvIf Request_URI "^/exams.*" accessgranted=1 <Location "/"> ...


0

See this bug where this should be fixed; which version are you on, and do you have ProxyPreserveHost On enabled?


0

It does matter. Quoting from the documentation for RewriteRule: The order in which these rules are defined is important - this is the order in which they will be applied at run-time.


0

Try following one of these: How to setup / install PHP 5.6 on Ubuntu 14.04 LTS | Dev Metal How To Install Linux, Apache, MySQL, PHP (LAMP) stack on Ubuntu | DigitalOcean


2

This way: RewriteEngine On RewriteCond %{QUERY_STRING} path=(http.*) RewriteRule .* %1? [R] If you want to retain the query string when redirecting, remove the ? from the third line. See the Apache wiki for more examples.


3

There are a lot of good technical answers provided already (please also have a look here: http://security.stackexchange.com/q/77/52572 and Tips for Securing a LAMP Server), but I still would like to mention here an important point (from yet another perspective) about the security: security is a process. I'm sure you have considered this already, but I still ...


0

I found that the file permissions were too restrictive in the cert file pointed to by "LDAPTrustedGlobalCert" However, with "LDAPVerifyServerCert Off", I thought reading of that root cert would be bypassed, and I wouldn't need to worry about permissions? No matter, it's fixed now


-1

Just add this line in httpd.conf: SetEnv LOGONSERVER \\\\machine


0

Yes it is possible. If you don't mind the speed hit, you can use MPM ITK to run each Apache as its own user (you'll need to set the proper filesystem ownership and permissions on each site's main directory so that other users can't get into it). That will allow you to still use mod_php. Be sure to read the "Quirks and Warnings" section on its homepage ...


1

I think the easiest solution is to move the directive from the server level to the virtualhost level, if the server-wide setting proves unacceptable for a vhost. Use a default Include in every vhost and omit it in the vhosts where you deviate from the norm. The new <If> (httpd 2.4) might be an option too.


0

IF you are using 'ldaps://ip address.......' in your ldap url try 'ldaps://full hostname.......'



Top 50 recent answers are included