0

I have been tracking down a bug which I have reduced to the following case. We have a web server running apache and it doesn't serve filenames including "/bin/sh" pattern outside of the campus in which the server is located (e.g. www.example.com/some/sub/folders/bin/show.html. Maybe related is that the same url with https in the beginning instead of http works without a problem once you skip the certification error. It is difficult to change all such filenames in our application so I'm trying to fix this issue instead. How can I debug this any further?

Log file /etc/httpd/logs/access_log shows an unrelated GET request url for this filename. Other filenames show up as they are. I have checked configuration files under /etc/httpd/conf and /etc/httpd/conf.d but I couldn't see anything related, although I'm not familiar with these configuration files.

Apache version is as follows:

# httpd -v
Server version: Apache/2.0.52
Server built:   Oct 29 2008 09:20:05

Any ideas?

EDIT

Log messages from inside the campus (response 304 for regular cached browser window and response 200 is for private non-cached browser window):

(ip addr) - - [27/Apr/2017:13:06:45 +0300] "GET /appserv/bin/sh.html HTTP/1.1" 304 - "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:53.0) Gecko/20100101 Firefox/53.0"
(ip addr) - - [27/Apr/2017:13:06:54 +0300] "GET /appserv/bin/sh.html HTTP/1.1" 200 154 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:53.0) Gecko/20100101 Firefox/53.0"

Log messages from outside of campus (tested with tor and various vps nodes):

(ip addr) - - [27/Apr/2017:13:08:08 +0300] "GET /cosbiom/component/option,com_extcalendar/Itemid,99999999/extmode,day/date,2031-02-04/ HTTP/1.1" 200 28936 "-" "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)"
Improve this question
2
  • Do the access_log entries for this url and other similar ones (not matching /bin/sh) look the same? If they both report success then I'm more confident that the problem lies outside the server. Could you add example log lines to the question?
    – Paul Haldane
    Apr 26, 2017 at 14:34
  • @PaulHaldane If by success you mean response 200, then yes they both do report success. I have added some example log lines.
    – none
    Apr 27, 2017 at 10:17

1 Answer 1

Reset to default
3

If this works on-campus but not from outside then it seems unlikely that it's an issue with the web server config (it could be but I suspect that sort of config would be pretty obvious).

It seems more likely to me that there's some sort of inspection-based firewall at the edge of the campus network based on a simple regular expression match. That wouldn't (in general) affect https traffic (since it's encrypted and so not open to inspection).

You need to talk to whoever looks after the campus's network connection (I'm assuming that you've try from multiple external connections so you're sure the problem is towards the server end).

Improve this answer
2
  • I guess it makes sense. If there were a configuration issue on our side then it would also happen for in-campus access. I will try to ask our IT about this. I have added the log files to the question if you want to comment on it.
    – none
    Apr 27, 2017 at 10:19
  • This indeed turned out to be an issue on the IT. Thanks for the help.
    – none
    May 3, 2017 at 14:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .