Hot answers tagged

4

OS must be upgraded. Doing so once a decade or so is the minimum to maintain these general purpose LTS operating systems. Not doing so is irresponsible, as end of life CentOS 5 has unpatched security vulnerabilities. Adding compensating security controls for vulnerable software is more work than upgrading it. You need a httpd major upgrade for other ...


3

I'm afraid you are doing it wrong. Instead of running one massive mega-instance you should run a fleet of smaller instances behind a load-balancer. For example replace m5.24xlarge with 24 x m5.xlarge, ideally in an auto-scaling group with spot instances to save costs. Some of the reasons are: If your big instance fails or needs maintenance your whole ...


2

Doh! I launched my browser from a machine that only had access to one of the two networks. No surprise it didn't work.


2

You can define multiple VirtualHosts for the same port, you just have to set different ServerName directives for each. If you want my.company.com to be the application at port 5000, and my-v2.company.com to be the application at port 5001, I'd suggest that you go with a configuration like this: # Enable name-based routing on port 80 and port 443 ...


2

You have php-cli and php-common packages installed. That means you've installed only cli version. Cli (console) version is the one you run with php command from shell. Those packages don't provide apache module that's why you don't see it. While sudo yum install php (or outdated mod_php, which is now an alias only) offers you to install php package, which ...


2

From the df -h output it should be pretty easy to spot the Use 100% with Avail 0. Your /tmp is full. Adding capacity to the / doesn't solve this. The question on how to increase directadmin tmp is discussed on DirectAdmin forums.


2

If I understand correctly, you want to redirect all non-HTTPS requests to HTTPS. So I guess your rewrites are in a <VirtualHost *:80> container, for a non-HTTPS site. Now you want to add another condition, to not redirect Lets Encrypt challenges. I think you're probably using the HTTP-01 challenge, which means you want to not redirect requests to http:/...


2

Well, I do have access to that subscriber-only article, and the solution it gives is pretty non-obvious. The problem described there is that at some point /etc/httpd was made a symbolic link to /opt/rh/httpd24/root/etc/httpd. This causes the old httpd package, which stores its configuration in /etc/httpd, to instead try to overwrite the files created by the ...


2

At least with the last Apache's version (2.4.38) with modsecurity enabled, only these methods are allowed by default: GET HEAD POST OPTIONS When a PUT request is made the error log of Apache2 returns this message: [Wed May 06 11:46:56.680835 2020] [:error] [pid 20162] [client 172.16.x.x:58147] [client 172.16.12.144] ModSecurity: Warning. Match of "within %{...


2

You can just reinstall the package containing the missing file. yum reinstall /opt/rh/httpd24/root/etc/httpd/modules/librh-php72-php7.so


1

Your Apache configuration is fine, the problem is your backend. Your backend is configured for the URL foo.bar:3000, so it redirects there when it is NOT reached via this URL. You need to configure your backend servers for the new URL. How to do this is different on every application server, a common name for such a setting is base url or something like this....


1

I believe it has been said before in many places, still, to make exceptions to proxy just append a ! at the end of the proxypass directive instead of specifying a target: ProxyPass /path ! PS: Better to not place ProxyPass directives inside Location directives, that tends to complicate things (Location, ProxyPass directices are interpreted in opposite order ...


1

I see two possible solutions: Check for empty CHECKSUM with: if failed ... checksum d41d8cd98f00b204e9800998ecf8427e then alert Regex should also work if failed ... content = ".+" then alert


1

You should be aware of security implications over running such outdated version of CentOS, I'm not gonna go over that, if you're doing it out of laziness please follow @John Mahowald's recommendations. Now, if you compile a static httpd on a newer Linux box it will run on your old CentOS, yet keep in mind that the compiled httpd binary alone is just a part ...


1

Scaling up on a very large web server instance is in fact possible. As httpd's warning suggests, you will need to tune the MPM. First select an MPM. event is nice and performant, but depending on your modules you may need prefork. MaxRequestWorkers was formerly known as MaxClient. Increase this as much as your memory allows. Take for example the simple ...


1

With Apache 2.4, Order allow,deny Allow from all Should be replaced by Require all granted Check your php.ini, if open_basedir has not been set to /var/www/html/... ; open_basedir, if set, limits all file operations to the defined directory ; and below. This directive makes most sense if used in a per-directory ; or per-virtualhost web server ...


1

The documentation for mod_access_compat mentions: Available in Apache HTTP Server 2.3 as a compatibility module with previous versions of Apache httpd 2.x. The directives provided by this module have been deprecated by the new authz refactoring. Please see mod_authz_host I would suspect that the messages may be logged by the new module, and so you ...


1

You do not need to check the requested URI using an if statement. Just create another location block and copy over the required statements. For example: location /foo/ { ... if ($http_authorization = "") { return 403; } proxy_pass http://foo_upstream/; } location /foo/anon_permitted { ... proxy_pass http://foo_upstream/anon_permitted; }


1

The correspondence between the URL space and files on the disk is ruled by Apache's DocumentRoot directive. If you have in your main or <VirtualHost> configuration file a line like: DocumentRoot /var/www/html (you probably have this set in /etc/apache2/sites-enabled/000-default.conf), then whenever you ask the server for http://example.com/path/to/...


1

In your case, you are wanting to conditional logging based on the response of a query. Most conditional logging, such as by IP or URL path, operates on the request. Prior to httpd 2.4, you might do something like the following to not log certain requests based on data in the request. eg. SetEnvIf Request_URI "^/wpad.dat(.*)$" noise SetEnvIf Request_URI "^/...


1

These requests look like someone's trying to use your webserver as a proxy. The error code 400 means that they didn't succeed. If these requests don't come with a Host: ... header, you could use one default VirtualHost to catch such requests and other VirtualHost environments using ServerName for your real website. Then you can use different log files for ...


1

Problem was solved by adding EnableSendfile Off into apache server config


1

The first thing to check is the output of apachectl -S. It shows which IP is listening on which port and for which virtual host. And it also shows the file and line number which configured it. Then you can add a GlobalLog directive for all virtual hosts, and increase the LogLevel while debugging, while still keeping your standard CustomLog files. For ...


1

Even in the edit you're checking for a condition in the outermost loop. Once that condition is satisfied that loop exits. Your description sounds like you're trying to do while true do HTTPD=`curl -A "Web Check" -sL --connect-timeout 3 -w "%{http_code}\n" "http://127.0.0.1" -o /dev/null` until [ "$HTTPD" == "...


1

Every time I have this problem, it is because I did something like: # yum install httpd php-mysql # yum install php-fpm # systemctl start httpd Finally I remember that this is not a dependency and get it working: # yum install php # apachectl -M | grep -i php php5_module (shared) # systemctl enable httpd # systemctl restart httpd At this point I can use ...


1

This was lifted up on the front page and I think the answer back from 2013 was based on an assumption that certificates are expensive and that OP can't buy one for example.com. In this era of free Let's Encrypt certificates there's only one answer: Get a certificate for the redirection. (Getting Started with Let's Encrypt). Create a simple redirection, ...


1

Note that if you have PrivateTmp=true set in your /usr/lib/systemd/system/apache2.service (or whatever it's called on your system), meaning Apache actually looks for /tmp inside something like /tmp/systemd-private-c27fc5b152d546159d675e170641529b-apache2.service-IcEt0m/, Apache won't be able to write to that dir and you won't get cores dumped at all (due to ...


Only top voted, non community-wiki answers of a minimum length are eligible