New answers tagged

0

The way I usually configure iptables or any firewall is, I do a default drop on the INPUT chain, but leave FORWARD and OUTPUT unchanged. The reasoning is as follows: INPUT chain limits which "outer packets" are allowed to pass through the firewall. So I stop unwanted packets from coming in at all. FORWARD chain only works on packets that are ...


0

I'll assume that your web server is not part of your home network. I'll assume that for setting up your web server, you have some type of console access to your web server. I'm making this assumption because you are changing the default policy on all chains (INPUT, OUTPUT, FORWARD) of your iptables filter table to DROP which would cause any remote ...


1

Putting something after example.com/index.php will cause problems. For instance: example.com/index.php/index.php or example.com/index.php/abc will not throw you a 404 error The /<something> that appears after a file, such as /index.php (duplicated) and /abc in the above examples is called additional pathname information (path-info). Whether this is ...


0

Ok. So it turns out that the above setting was indeed working, however, in absence of Content-Length, mod_jk can only send a maximum of 8kb of un-compressed data to Tomcat (It can be increased to a maximum of 64kb, 'max_packet_size') and the data I was sending was more than that, in some cases. So that is the limit we need to live with, I guess.


1

Note: personally I think of webdav as being an obsolete protocol, and generally there are newer, easier tools for sharing files securely. I like syncthing That said: You could combine the webdav module with apache's Authentication and Authorization modules to achieve user and group level access to specific webdav directories as described in this tutorial: ...


0

It sounds like you need to set the environmental variable for apache. IIRC these days that is done in /etc/systemd/system/httpd.service.d/override.conf and you're after content like [Service] Environment=JK_IGNORE_CL=true You didn't specify what JK_IGNORE_CL should be set to so I've assumed true


1

You could use the FilesMatch directive to deny access to these files like this: <FilesMatch "\.(save|swp)$"> Require all denied </FilesMatch> Either add this to a .htaccess file or to the corresponding <Directory> block of your vhost configuration. Also consider to block other file types that could leak sensitive information, ...


0

I found solution for me Install "Visual C++ Redistributable for Visual Studio 2015 x86" error solve for me and Apache server start successfully


0

This problem often happens in Windows because of smaller Apache’s default stack size. And it usually happens when working with php code that allocates a lot of stacks. To solve this issue, add the following at the end of apache config file, httpd.conf <IfModule mpm_winnt_module> ThreadStackSize 8888888 </IfModule> For more information refer ...


0

I'm not 100% convinced your issue is really window-size related. Still, below you can find the relevant info. The base window size can not exceed 65535 bytes due to limitations of the TCP header. From RFC 1323: The TCP header uses a 16 bit field to report the receive window size to the sender. Therefore, the largest window that can be used is 2**16 = 65K ...


0

I am using Apache 2.4.25. You can list available modules: ls /etc/apache2/mods-available/ List enabled modules: ls /etc/apache2/mods-available I load the Alias module like this: a2enmod alias Then as mentioned in Felipes answer, update the virtualhost file with something like... <VirtualHost *:80> DocumentRoot /var/www/html/ Alias &...


0

I wasn't able to find any answer for the above issue so I turned to a different solution. I set up an nginx reverse proxy with SSL termination. This way both http and https traffic is pointing to port 80 on the backend. No more redirects loop


1

Whilst I still haven't proven if <VirtualHost *:443> is actually working properly or not, I did still manage to solve the problem I was having by inserting my configuration for <VirtualHost *:443> outside of the tag. Maybe not a solution to my original question, but that's irrelevant now considering my ProxyPassReverse now works properly.


-1

You can use the build-in directive so no need to the extra module https://httpd.apache.org/docs/2.4/mod/core.html#enablesendfile


0

... "GET / HTTP/1.1\n" 400 3279 "-" "-" The line ending in a HTTP request should be \r\n and not \n. Try the -crlf option of s_client to translate an Enter into \r\n instead of only \n. Also the server might have some limit in which time the request should be fully sent and it might not be fast enough to just type everything. ...


0

You did actually send a malformed request. HTTP/1.1 requires the presence of the Host: header, and further with SNI, the content of the Host: header must match the SNI hostname. Try again and this time provide the correct Host: header.


3

The Allow, Deny, and Order directives, provided by mod_access_compat, are deprecated as of version 2.4 and will no longer work. Use Require instead: Require ip 123.123.100.100 Require ip 200.200.44.59 The Require directive is provided by the mod_authz_host module. More infirmation can be found in the Apache HTTP Server documentation


1

To allow specific IP addresses to access the site you should have: <RequireAny> Require ip 118.x.x.x Require ip 103.x.x.x Require ip 116.x.x.x </RequireAny> A little more info you can find in Apache documentation here: https://httpd.apache.org/docs/2.4/howto/access.html I have in mind this: The Require provides a variety of different ways ...


1

So the backend server is the target of the proxy, so the Proxy directive is not relevant there. To restrict access to the backend, something like this in the virtualhost of your backend conf file would limit access to only the front-end server making proxied requests... <VirtualHost *:80> DocumentRoot "/var/www/example.com" ServerName ...


0

It appears that my problem was related to the findtime portion of my jail. Observing the log hits, I realized they were more spaced out than fail2ban was detecting (1-2 minutes apart). I changed it to findtime = 120, and it began banning. So, anyone out there having this problem, if the rest of your configs are correct, and your regex is sound, pay attention ...


2

Just found the answer: ProxyPreserveHost On https://httpd.apache.org/docs/2.4/mod/mod_proxy.html#proxypreservehost


0

The following config does the trick for me (Ubuntu 20 with Apache2 v2.4.41 and openssl 1.1.1f): SSLProtocol all -SSLv2 -SSLv3 SSLCipherSuite CDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:...


1

For your second rewrite expression RewriteCond %{REQUEST_URI} /cgi-bin/something? RewriteCond %{QUERY_STRING} ^keywords=([0-9]{1,})$ This matches will match the string /cgi-bin/something?keywords=123 But will not match /cgi-bin/something?keywords=123&offset=120 The regex you are using ^keywords=([0-9]{1,})$ has a dollar sign ($) saying that after the ...


3

You can solve the problem in your option #1 (which, as you said, is a much better approach) by setting the HTTP_X_FORWARDED_PROTO in your nginx config with proxy_set_header X-Forwarded-Proto $scheme; and configuring WordPress to recognize it by appending this line to wp-config.php if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['...


1

Normally I would prefer to do all the heavy lifting on the reverse proxy and keep the backend site that gets exposed as original as possible. Your problem seems to be in essence that the (WordPress) backend generates and uses (absolute) URI’s that differ from what you want visitors to use. You can remedy that by rewriting the (HTML) content that WordPress ...


3

You should be able to tell Apache that the incoming request is being proxied from a HTTPS request with the proxy_set_header X-Forwarded-Proto "https"; declaration in the first setup


0

Note that you’re including additional TLS settings and Apache will sometimes do some counter intuitive merging when repeating directives Include /etc/letsencrypt/options-ssl-apache.conf Protocols h2 so protocols directive in the VirtualHost specific section may not be taking effect. (Check/post the included options) Also if you’re running multiple ...


0

This has, of course nothing to do with a business IT environment. A couple of tips, though: Don't use ".local" domains in real life. They cause more trouble than they're worth. The yearly cost of a domain name is not high and will open up more opportunities to learn as a hobbyist. To solve your problem you don't necessarily need to switch operating ...


0

Thanks to @MrWhite in the comments, on Centos I discovered a file called /etc/httpd/conf.d/welcome.conf which contains: <LocationMatch "^/+$"> Options -Indexes ErrorDocument 403 /.noindex.html </LocationMatch> Since there is no file called .noindex.html the 403 error document itself was triggering an internal 404 error. ...


0

I can only assume this is some conflict with WordPress's mod_rewrite rule It actually looks like the opposite is happening. Only when you request https://wordpress-test-site.com/<something> do the mod_rewrite directives actually do anything. When you request the document root, then the mod_rewrite directives simply don't match and instead the request ...


1

A lot of companies do not use end to end encryption, yet they have configurations similar to yours. BShea is correct, it will work, and a proxy is the route you want to go. Here is an example. Tomcat has connectors, with the HTTP connector turned on by default. Apache has the same concept, allowing for HTTP and HTTPS traffic, with HTTP enabled by default. ...


0

A browser will go to whatever IP address www.example.com resolves to in the DNS. The server running at that address will need to act as a proxy to fetch the static content, or redirect the browser to the external location. There are various ways to do this using HAProxy, mod_proxy, Apache RewriteRules, etc. However, there is no way to get www.example.com to ...


0

RewriteCond %{REQUEST_METHOD} ^(GET)$ RewriteCond %{REQUEST_URI} ^/api/users(.*)$ RewriteRule ^/api/users(.*)$ http://localhost:5000/api/users$1 [P] RewriteCond %{REQUEST_METHOD} !^(GET)$ RewriteCond %{REQUEST_URI} ^/api/users(.*)$ RewriteRule ^/api/users(.*)$ http://localhost:7000/api/users$1 [P]


0

I'd run the java in a docker container, then use traefik to serve the main domain and the subdirectory from different containers or hosts. Or you could use haproxy, then you probably would need to bind the java to another port.


1

I suggest you to use subdomain to do this. ex- https://example.example.com


0

I haven't tested, but you can try something like below. You'll need to tweak with the conditional setting of ROUTEID. If the header does not work, you will have to try cookies as outlined in various examples. <IfModule mod_headers.c> <If "%{REQUEST_METHOD} =GET"> Header set ROUTEID: "1" </If> <Else&...


0

The answer is: <FilesMatch \.(php|phar|html)$> SetHandler "proxy:unix:/run/php-fpm/www.sock|fcgi://localhost" </FilesMatch>


0

*Forgot to post the answer instead of commenting back then Just remove the upgrade=WebSocket patameter and it should work without any problem.


0

First, you need to erase your VPS and start over with a fresh installation of CentOS 8, because you have run pip3 install mod_wsgi and trying to clean up from this (if it's even possible) will take significantly longer than just starting fresh. Next, you need to choose whether you want Python 3.6 or Python 3.8. By default Python 3.6 will be used, but you can ...


2

Solution RewriteRules must use \x instead of % in order to match %-encoded URLs! (PCRE syntax for byte sequences) mod_rewrite-config uses PCRE regex syntax, and operates on decoded URLs, so typing a %-encoding in a RewriteRule pattern causes it to look for the literal %-character, not an encoded value. The correct escape-character in RewriteRules is \x, so ...


1

As was mentioned in one of the comments, the issue is that the server is running out of RAM. This is a typical misconfiguration. You are hosting a website or otherwise publicly accessible service on the Internet. Any traffic should be expected. There are too many "wild" things out there: scripted malware, bots, "digg effects", targeted ...


2

You can't "convert encodings" as such using only mod_rewrite, however, you can search for that specific sequence of characters in the requested URL and "correct it". http://localhost:60151/load?file=http://example.org/project²/some/data/file.bam RewriteRule (.*)project%B2/(.*) $1project²/$2 [NE] Note that project² appears as part of ...


2

Because %2 is a backreference in mod_rewrite substitution strings, that would otherwise refer back to the 2nd captured subpattern in the last matched CondPattern. There is none in the example you posted, so this is replaced with an empty string - so it looks like it is simply "stripped". For any sequent of %n (where n is 0-9), you need to backslash ...


1

The main advantage of placing your web site in a virtual host is that the default (virtual) host, which Apache's syntax doesn't place inside any <VirtualHost> block, will catch requests for any site other than yours. This includes things like localhost (if you didn't make a virtual host for it), the system's IP address, no host specified, etc. Nearly ...


2

RewriteCond "%{QUERY_STRING}" !^v=${versions:version} This doesn't work because the CondPattern (2nd argument to the RewriteCond directive) is a regex and consequently does not support variable expansion. (Just as you can't use backreferences of the form $n or %n or server variables %(SERVER_VAR} or env vars %{ENV:MY_ENV_VAR} etc.) It would ...


1

You could do it like this RewriteEngine On RewriteRule ^/(.*)$ https://www.example.com/$1 [R=301,L]


0

So I was able to get this to work by using stunnel and user/pass auth. <LocationMatch "/folder/"> AuthType Basic AuthName "TestSite" AuthBasicProvider ldap AuthLDAPUrl "ldaps://localhost:1636/dc=domain,dc=com?uid" AuthLDAPBindDN <USER> AuthLDAPBindPassword <PASSWORD> Require ...


0

personally, I would favour a solution using either a firewall, or ssh port forwarding and localhost, to expose the phpmyadmin service in a secure manner to trusted hosts, and definitely use decent authentication rather than "obscurity security". However to try to answer the question at hand... Because you only have one VirtualHost on each port, ...


0

This has been solved. A NAS device on the network was adding ports 80 and 443 to the router on it's own duplicating those of the Apache server and confusing it.


0

On Debian (and so, on Ubuntu as well), the preferred way to create sites is to create them in the /etc/apache2/sites-available directory (named something.conf), then run the a2ensite something command, where something is the name of the config file without the extension. Similarly, enabling config snippets (these are in the /etc/apache2/conf-available ...


Top 50 recent answers are included