2

I'm running a development LAMP server on Ubuntu 14.04. Today i have taken a look at the access.log and i found lots of these lines:

::1 - - [05/Jul/2015:01:24:14 +0200] "OPTIONS * HTTP/1.0" 200 110 "-" "Apache/2.4.7 (Ubuntu) OpenSSL/1.0.1f (internal dummy connection)"

and so much more of these:

127.0.0.1 - - [05/Jul/2015:01:50:01 +0200] "POST / HTTP/1.1" 403 347 "-" "-"

I was wondering whether this may be a problem caused by a miscoded RewriteRule (i am talking of about 1500 lines like the second one above only since the 5th July), or if i should take a deep look into a potential hack into the server or at least an attempt to do it.

What is your opinion? thanks

EDIT

This may be useful:

into the apache's error.log i've found:

[Mon Jun 29 01:24:31.082231 2015] [rewrite:error] [pid 5311] [client 127.0.0.1:33583] AH00670: Options FollowSymLinks and SymLinksIfOwnerMatch are both off, so the RewriteRule directive is also forbidden due to its similar ability to circumvent directory restrictions : /var/www/html/

the weird thing, imo, is that i am running this server with these settings since May 2015 and this is the first time i get these errors. If it was a RewriteRule problem, why only now...?

1 Answer 1

0

For the first "error" see https://wiki.apache.org/httpd/InternalDummyConnection. Apache by default sends these internal wake-up requests to all its children.

If you wish to exclude them from your log, you can use normal conditional-logging techniques. For example, to omit all requests from the loopback interface from your logs, you can use

SetEnvIf Remote_Addr "127\.0\.0\.1" loopback

and then add env=!loopback to the end of your CustomLog directive.

The second "error" means somebody from localhost is issuing POST request to the / path and getting Forbidden (HTTP 403) result. From the log it is not known what virtual host is that for. If you get these lines periodically, then it is probably some cron job or some kind of monitoring running on your system.

For the third "error" you have .htaccess file in the directory /var/www/html/. For mod_rewrite to work from inside .htaccess, it is needed to enable that mentioned parameter (Options +FollowSymLinks or Options +SymLinksIfOwnerMatch, the latter slightly more secure). As both are disabled in your case, the RewriteRule is ignored. (I'm not sure if it is only ignored or also causes the 403 error mentioned above as the error mentioned it being forbidden).

1
  • +1 for the first point. I still have concerns about point 2) because i perfectly know which cron jobs there are set up in my server and none of them actually involves Apache. about the 3rd, i guess i found the problem: i am testing password reset and email verification scripts and i have made a typo (mmh, not actually a typo, more an error caused by 10 hours of programming) in write the URL: i wrote exmaple.com/reset/?token=xxxxxxxxx with the senseless forward slash after "reset".. i guess mod_rewrite became crazy trying to find that file..(i have mod_rewrite to delete .php extension)
    – Jhon Zunda
    Jul 8, 2015 at 15:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .