Hot answers tagged

82

From the article you linked, there are three recommended steps to protect yourself against this vulnerability. In principle these steps apply to any software you may use with SSL/TLS but here we will deal with the specific steps to apply them to Apache (httpd) since that is the software in question. Disable Export Cipher Suites Dealt with in the ...


49

As Ron Garrity says, you can use Curl like this: curl -Iv http://www.aptivate.org 2>&1 | grep -i 'connection #0' And it outputs these two lines if keep-alive is working: * Connection #0 to host www.aptivate.org left intact * Closing connection #0 And if keep-alive is not working, then it just outputs this line: * Closing connection #0 The output ...


49

Solution is on Apache 2.2 documentation on the Virtualhost directive: Syntax: ... (...) Addr can be: The IP address of the virtual host; A fully qualified domain name for the IP address of the virtual host (not recommended); The character *, which is used only in combination with NameVirtualHost * to match all IP addresses; or The ...


35

Use chkconfig to manage the runlevels under which you want this service to start. Usually chkconfig httpd on does the job.


32

The fastest and easiest is to use a version directory such as /var/www/version/01 /var/www/version/02 and use a current symbolic link as your html_root : /var/www/html -> /var/www/version/02 This technique integrate perfectly into a revision control system (svn, git, mercurial, ...) as you can checkout branches & tags, changes the symbolic link ...


32

So I found that another service had a defined status for TCP port 5000. But by replacing the -a option with -m for modify, added tcp port 5000 to http_port_t So the command that worked was: # semanage port -m -t http_port_t -p tcp 5000


30

To get it to work outside of localhost, do php artisan serve --host 0.0.0.0 If you want it to work without specifying the port in the browser, php artisan serve --host 0.0.0.0 --port 80. sudo will likely be required. Note: php artisan serve should never be used for production. It's for dev and demonstration only and won't be able to handle more than a ...


25

a2ensite etc. are commands available in Debian-based systems and that are not available in RH-based distributions. What they do is to manage symbolic links from configuration file parts in /etc/apache2/sites-available and mods-available to /etc/apache2/sites-enabled and so on. E.g. if you have a vhost defined in a config file /etc/apache2/sites-avaible/...


21

The -DFOREGROUND option does indeed mean that Apache won't fork, but that doesn't mean that it's attached to your shell! The service is started by systemd when you run systemctl start httpd (or the old style way, service httpd start). It is systemd to which Apache is attached, and systemd is managing the process as one of its children. This is done so that ...


21

I created this file: sudo vi /etc/systemd/system/nagios.service and added the following: [Unit] Description=Nagios BindTo=network.target [Install] WantedBy=multi-user.target [Service] User=nagios Group=nagios Type=simple ExecStart=/usr/local/nagios/bin/nagios /usr/local/nagios/etc/nagios.cfg Then the following: sudo systemctl enable /etc/systemd/...


20

There is probably some forgotten configuration in /etc/httpd/conf or /etc/httpd/conf.d. Find (grep SSL /etc/httpd/{conf,conf.d} -r) and destroy it or install ssl module for Apache: yum install mod_ssl


19

I believe that on Linux, binding to [::] (IPv6) results in receiving both IPv6 and IPv4 traffic (by default). I believe these are referred to as IPv4-mapped IPv6 addresses. netstat simply shows the IPv6 entry only, because there's technically only a single bind, that happens to support both IPv4 and IPv6. There's a bit of information on the Apache site. ...


16

The way you disable a service under just about any RedHat-derived distribution is with the chkconfig command: # chkconfig httpd off And to stop a running service: # service httpd stop These commands will Do the Right Thing regardless of whether your system is running systemd, upstart, or vanilla SysVInit. For what it's worth, despite running upstart ...


14

Renaming the directories without shutting Apache down should work as well. That will shorten the window significantly. mv public_html public_html_old && mv public_html_new public_html should finish in a fraction of a second. A couple of drawbacks are that this approach will give a 404 to any request that still manage to happen during the window. And ...


13

Using a load balancer is a good idea. If the site is important enough to worry about a few seconds of downtime, it's important enough to worry about fault tolerance. That aside, if this is on a UNIX system you can put Apache on hold during the rename (or symlink update, etc.): killall -STOP httpd # Pause all httpd processes mv public_html public_html_orig ...


12

I recently ran into this exact problem using Plesk 9.5 on CentOS. I cannot say for sure whether it was caused by an update to Plesk, or not. The customer doesn't think any changes were made recently, but Apache failed to start with this error. After an assesment of the system to ensure it wasn't due to a breach, I did some troubleshooting and determined ...


11

Here is a good explanation of how it works with gifs: https://www.datadoghq.com/blog/monitoring-apache-web-server-performance/ Briefly: if you on 2.4 and you need httpd as a reverse proxy (dispatcher) so your choice is an Event MPM


11

SSLCACertificateFile /var/cosign/certs/CA/publickey.pem Unless that PEM file actually contains the CA certificate for the client certificates you wish to grant access, this is incorrect; to provide apache with a certificate chain, use SSLCertificateChainFile instead. Apache must have the actual certificate and any intermediate certificates used to sign/...


11

Symlinks and mv are your friends, however, if you really need to avoid end-users getting an error page while deploying a new version, you should have a reverse-proxy or a load-balancer in front of at least 2 backend servers (apache in your case). During the deploy, you just need to stop one backend at a time, deploy the new code, restart it and then iterate ...


11

There seems to be a lot of possible questions here, a bit unstructured for a "response". Let me see if I can help answer some. Determine which Multi-Processing Modules (MPMs) is in use. The "easiest" way is to dump any currently running modules and select out the mpm ones to see what's running. Here are two methods: # apachectl -M | grep mpm ...


11

On the systems I have to hand (C6, C7 and F24), tcp port 5000 has an SELinux context of commplex_port_t. This will be why, when you try to add it you get the error message /usr/sbin/semanage: Port tcp/5000 already defined To change the context of tcp port 5000 from commplex_port_t to http_port_t you will need to use the -m | --modify switch -m, --modify ...


11

My first guess would be /etc/hosts which can override DNS (if it exists for the host) and substitute almost entirely for forward DNS when it's missing. For whatever reason this host (dbl) was in /etc/hosts and then it wasn't. Secondarily, let's say /etc/resolv.conf lost the search option for the local domain, so that dbl.foo.com resolves but dbl does not... ...


10

Sounds like you forgot to add an allowance for TCP port 80 requests inbound in the security group for that server. Here's some info on EC2 security group config


10

With Apache 2.4, the official module to use is mod_proxy_fcgi (tutorial) instead of the ancient mod_fastcgi. That module, as well as mod_fcgid, were third party modules. And of course there's always nginx.


10

OK, so I think I was on the right track. After searching on the Web about the recently installed updates, the KB4338818 is the one causing problems. This is happening for other softwares, like FileZilla Server, as detailed here. I've just uninstalled this Security Update and now Apache can be started/stopped as normal! So I hope Microsoft will fix this ...


9

Disable SELinux or run in ROOT setsebool -P httpd_enable_homedirs on chcon -R -t httpd_sys_content_t /home/ chcon -R -t httpd_sys_rw_content_t /home/


9

If you are applying changes regularly on a production system, I would take care of a structured life cycle. A good practice is Capistrano http://capistranorb.com/. This is a an open source solution for deploying software on one or more servers on several platforms and configurations. For Magento there is even a plugin: https://github.com/augustash/...


8

It's an RFC thing as detailed by Apache. By default, Apache will accept requests even if they contain invalid URIs, but instead the user will be redirected to your server's main page. The CONNECT requests being refused is proper behavior. As detailed in the link above, you can manually block these requests, but there's no immediate need to.


8

okay, i've found the reason , these graceful restarts are happening because of log rotations (crond gracefully restart the http service after log rotation) some logs are getting rotated very frequently (because of some misconig). Thats all


8

This is how to get CGI Perl scripts executing correctly on CentOS 7. I'm leaving this here as it seems a lot of the resources on the internet don't combine the steps and leave people like me very confused. In short this, is what needs to be done. Install software. Create your test CGI file. Ensure the CGI module is loaded. Inside httpd.conf. Change the ...


Only top voted, non community-wiki answers of a minimum length are eligible