Tag Info

New answers tagged

0

You don't mention which OS this is working with, so I'll keep it generic. It's possible that the mod_rewrite module isn't enabled and so the config is ignored due to the <ifModule mod_rewrite.c> You need to confirm that this module is actually loaded. Also you don't need two sets of <IfModule ...> This currently works for me: <IfModule ...


1

I would like to add to the previous answers that the most important is not how you call the directories (though that is a very useful convention), but what you actually put in nginx.conf. Example configuration: http { include /etc/nginx/conf.d/*.conf; include /etc/nginx/sites-enabled/*.conf; include /etc/nginx/sites-enabled/my_own_conf; ... } ...


2

You can use Include for this. It's the correct way to chain together several files.


0

You'd want to make sure your MaxClients is set to something comfortably above the typical peaks (which is sounds like is 10 in your case but you saw a burst up to 86 once, so maybe 150 to allow some breathing room in case you get a bigger burst). This way you won't run out of connections should that happen and users experience slowness. Be sure you have ...


2

There's a nice summary of the difference between ChallengeResponseAuthentication and KbdInteractiveAuthentication at http://blog.tankywoo.com/linux/2013/09/14/ssh-passwordauthentication-vs-challengeresponseauthentication.html - summary is that ChallengeResponse often ends up just asking for password (but insists on it being supplied interactively). ...


1

As of Ansible 1.9, the value for key can be a url, obviating the need for curling the url via the shell module. Example: - name: Add my SSH key authorized_key: user=jeffwidman key=https://github.com/jeffwidman.keys


0

Some directives can be applied for both "server" and "location" contexts, making it DRY: # The variables below are evaluated on each request, # allowing to DRY configs of locations. proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_set_header X-Real-IP $remote_addr; location /special { ...


1

Ended by doing ssl redirection in application level Route::filter('check.ssl', function() { $segment = Request::segment(1); if ( ( $segment == 'secure') && ( !Request::secure() ) ) return Redirect::secure(Request::getRequestUri()); else if ( ( $segment != 'secure') && ( Request::secure() ) ) return ...


0

Replace this: location ~ ^/(secure) { try_files $uri $uri/ /index.php$is_args$args; location ~ \.php$ { try_files $uri =404; fastcgi_pass 127.0.0.1:9000; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include fastcgi_params; } } return 301 ...


1

I would put them in a separate class, e.g. "wildcard_ssl_", and probably include that from both of 'webappX' classes, or maybe from both profiles instead.


0

In your nagios.cfg file, you can add a line pointing to the hostgroups.cfg file you created, thus telling nagios to include that file. cfg_file=/usr/local/nagios/etc/hostgroups.cfg You can also specify a directory, and nagios will process any of the files found within: cfg_dir=/usr/local/nagios/etc/directory_containing_cfg_files


0

I don't think it is possible to have a port with tagging enable AND without.. Either you are in access mode with an id configured (no tagging), Either you configure multiple id on the port in access mode. Either you are tagging on that port,with à single id Either you are tagging multiple id to isolate trafic, it is called a trunk I think what you need ...


0

Now with the changed topic, this becomes a question for iptables. What I currently use (in overly simplified form) is: iptables -I INPUT -m tcp -p tcp --syn --dport 80 -m connlimit --connlimit-above 20 -j LOG --log-prefix "DoS Filter(connlimit): " iptables -I INPUT -m tcp -p tcp --syn --dport 80 -m connlimit --connlimit-above 20 -j DROP obviously you may ...


2

Just going to quote from my working Postfix configuration: smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauthenticated_sender_login_mismatch, permit Note that this allows authenticated users to send mail with any FROM address they wish. If you want users to be able to send mail only with ...


0

for newer Tomcats use sslProtocols and sslEnabledProtocols combo like this: <Connector port="8443" maxHttpHeaderSize="8192" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" enableLookups="false" disableUploadTimeout="true" acceptCount="100" scheme="https" secure="true" clientAuth="false" sslProtocols="TLSv1,TLSv1.1,TLSv1.2" ...


0

If, like me, you found this answer but were looking for the dynamic config (cn=config) option, use the following ldif. dn: cn=config changetype: modify replace: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /path/to/host.key - replace: olcTLSCertificateFile olcTLSCertificateFile: /path/to/host.crt - replace: olcTLSCACertificatePath ...


0

A partially educated self-response. php-fpm, unlike suphp, does not allow running as the script owner but instead allows setting up pools that specify a user and group to run as. In Centos 7 with Apache 2.4, I found these declarations in /etc/php-fpm.d as www.conf. I created a duplicate of this file and put in one virtual hosts's username as user and ...


0

As Jim says the examples on the OpenVPN site use # for comments and ; to comment out settings. There is no functional difference but this convention makes it easier to visually identify settings that are commented out. From https://openvpn.net/index.php/open-source/documentation/howto.html#examples ################################################# # Sample ...


1

CheckNonce is part of mod_manager config, you can set CheckNonce Off in your Apache mod_cluster config. Eg: <VirtualHost *:6666> <Location /> Order deny,allow Deny from all Allow from 10.33.144. </Location> CheckNonce Off .... </VirtualHost>


0

If you have access to IIS then this also fixes the problem: http://httpjunkie.com/2014/884/svg-no-iis/


2

Remove the Satisfy All directive or change it to Satisfy Any, as is not needed because you're not using authentication directives for the directory .


0

Ok I found a solution. It's better to use some location directives for this problem. So, now my config is : server { listen 80 default_server; server_name sub2.sub1.example.com; ##### Non HTTPS conf ##### location ~* ^/toto/[abc]/ { # This replace the "server_name ~^sub2\.sub1\.example\.com/toto/[abc]/.*$;" config block ... } ##### ...


0

To disable SSL 3 (POODLE) in Jboss 4.0.3 SP1 (Tomcat 5.5 with java 1.5) in server.xml change your code like this. <Connector port="443" address="${jboss.bind.address}" maxThreads="100" strategy="ms" maxHttpHeaderSize="8192" emptySessionPath="true" scheme="https" secure="true" clientAuth="false" ...


2

There are IncludeDir and IncludeFile options available from RHEL/Centos 6.5: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.5_Technical_Notes/net-snmp.html



Top 50 recent answers are included