Skip to main content
41 votes

Ordering: 1. nginx 2. varnish 3. haproxy 4. webserver?

Foreword Update in 2016. Things are evolving, all servers are getting better, they all support SSL and the web is more amazing than ever. Unless stated, the following is targeted toward ...
user5994461's user avatar
  • 3,038
38 votes

Should my website have an IPv6 address?

Lack of IPv6 support on your site will hurt some of your users. According to stats published by Google 20-25% of users currently have IPv6. A large fraction of those users will need to go through ...
kasperd's user avatar
  • 30.8k
12 votes

SSL for devices in local network

Step 1: Make the device generate a self-signed certificate for its IP address and/or hostname on first setup or when the IP address is changed unless there is a customer-provided certificate in place. ...
Mikael H's user avatar
  • 5,149
9 votes

Allow a certain URL path with Squid

For anyone else like me that stumbles across this post looking for an answer. The reason is that squid can't see the full URL for HTTPS requests, only the domain. You can do a url_regex only for ...
Mike Evans's user avatar
9 votes
Accepted

With IPv6, should we be assigning distinct IP addresses to each host name served over HTTP(S)?

Giving each website its own address makes it easier to see which website traffic is for on the network. This can help with accounting, attack detection and prevention and things like that. It may also ...
Sander Steffann's user avatar
8 votes
Accepted

Why is the TTFB of requests 5 times longer when a new TCP session is created on Apache?

Yes, it is normal that non-persistent connections take longer to send first byte of data. This is because the IP address has to be resolved from the DNS, the TCP connection has to be set up, then the ...
Tero Kilkanen's user avatar
8 votes
Accepted

How to redirect port 80 to 8080 while keeping 8080 closed to the Internet?

This schematic should help you understand how packet handling is done: The filter/INPUT rules see only packets after they were NATed in nat/PREROUTING, so by default can't tell the difference between ...
A.B's user avatar
  • 13k
8 votes

SSL for devices in local network

In one of our projects we faced a problem, that we wanted to connect to websocket on a local network from webpage, that was served from the Internet. In order to use secure web socket connection (wss:/...
Marcin D's user avatar
7 votes

Expose Fileserver (SMB) over WEB / HTTP(S) Interface

NextCloud has WebDAV functionality / integration and can replicate data between off-site <-> on-premises in the way you want. This is no open source / free software, but you might want to give it a ...
BaronSamedi1958's user avatar
6 votes
Accepted

Connecting to IPv4 server from an IPv6 address

Short answer: NO Long answer: IPv4 and IPv6 are different protocols. In theory you can connect from IPv6 address to IPv4 service, but you need NAT64 for this and this is primary designed for IPv6 ...
Quantim's user avatar
  • 1,368
6 votes

Expose Fileserver (SMB) over WEB / HTTP(S) Interface

Pydio has Web UX for CIFS/SMB shares: https://pydio.com
batistuta09's user avatar
  • 9,200
6 votes

SSL for devices in local network

I deal with this issue extensively for my current job - including high emphasis on the works-offline issues. I'm coming at the question with the precondition that enterprise-ish elements like adding a ...
AndrewL's user avatar
  • 191
5 votes

HAProxy redirect multiple domain

You can route to different backends for multiple FQDNs as long as you have the cert/key for the sites. HA proxy needs to be able to decrypt the traffic and read the host header, unless you want to ...
Jeff W.'s user avatar
  • 521
5 votes

Connecting to IPv4 server from an IPv6 address

Updated to reflect comments: My answer below is incorrect, but I suspect (i.e. hope) I am not the only person to have been under similar misconceptions, and that this answer (and more so, its comments)...
iwaseatenbyagrue's user avatar
5 votes
Accepted

automatic dedicated access_log for each client using ip in naming

Use the Apache log pipe feature: logs can be sent to an outside process. That process will have full latitude to filter things as it wants and create files as needed. See http://httpd.apache.org/docs/...
Patrick Mevzek's user avatar
5 votes

How can I check if my IIS site is using NTLM or Kerberos?

If you have access to your IIS server then the answer is much simpler than inspecting HTTP traffic: Simply view the site Authentication module config for Windows Authentication. In IIS Manager ...
JohnC's user avatar
  • 2,654
4 votes
Accepted

Strange scans from robots

They scan to know if you are at risk, thus to hack you later on if they can get their hand on those files. It's often php config's file (with database password in it), wordpress's config file, etc.. ...
yagmoth555's user avatar
  • 17.2k
4 votes

What will happen if a CPU burst up to 100% utilization in an SMP infrastructure?

If the utilization of one of the CPU in the quad-core system happens to be 100%, and it is being fixed to the interrupt to the NIC interrupt. Will the kernel schedule another CPU that is not very busy ...
David Schwartz's user avatar
4 votes

Expose Fileserver (SMB) over WEB / HTTP(S) Interface

I guess OwnCloud might be a bit overkill for your needs, but still going to mention it. :)
Janne Pikkarainen's user avatar
4 votes
Accepted

Is it better to redirect root to www or www to root?

The www. prefix is a remnant from the glorious old 90s when you had a single machine for each service, like FTP, WWW, SMTP etc. and had to use a separate hostname for each one. The apex/bare domain ...
AlexD's user avatar
  • 10.4k
3 votes

How to protect origin server?

The IP address that accessed your site is passed in CloudFlare's own CF-Connecting-IP header. You should always use this instead of X-Forwarded-For, as that can be supplied by the user and contain ...
Michael Hampton's user avatar
3 votes

Hidden development server

Put the server on a private network and require connecting to a VPN in order to access it.
EEAA's user avatar
  • 110k
3 votes

Active Directory Domain same as web domain

From the doc you linked to: make your internal domain a subdomain of your external domain You should not be creating your active directory domain name with the same domain name as your public ...
Mark Henderson's user avatar
3 votes

How to redirect port 80 to 8080 while keeping 8080 closed to the Internet?

REDIRECT just changes the port number, so if the connection was: client -> public_addres:80 it becomes client -> public_address:8080 So, you will not be able to block and accept at the same ...
Eduardo Trápani's user avatar
3 votes

OpenBSD relayd forward to web server based on HTTP request path

Somebody on IRC explained it for me. Because relayd rules operate on a "last wins" basis, I need my most specific match to appear last. The following works for me. table <apihosts> { ...
Ishpeck's user avatar
  • 224
2 votes
Accepted

Email routable domains?

Receiving: You need an MX record for that domain (then it can be used to receive emails). A mail exchanger record (MX record) is a type of resource record in the Domain Name System that specifies a ...
BastianW's user avatar
  • 2,888
2 votes

How to know where my site is hosted?

Your IP address is 204.197.240.85, I got this by looking up your hostname in the DNS. dig www.drpradeepjain.org ... ;; ANSWER SECTION: www.drpradeepjain.org. 600 IN A 204.197.240.85 ...
user9517's user avatar
  • 116k
2 votes

what is the maximum http response latency?

No RFC seem wrote for that ! but there is some default value from major web server. IIS: connectionTimeout; The HTTP.sys Timer_EntityBody timer expired. The connection expired before the request ...
yagmoth555's user avatar
  • 17.2k
2 votes

Nagios Disable service check if host unreachable

Service checks are still being run, it's just the notifications that get suppressed. Since nagios 4.1.1 you can disable service checks by adding host_down_disable_service_checks=1 to nagios.cfg. ...
Bangaio's user avatar
  • 300
2 votes

Apapche web server redirect unsupported ciphers to http?

When we turn off support for TLS 1.0 on our web server can we redirect browsers that don't support TLS 1.1 or higher to a http page explaining why they don't have access and what they can do about it?...
HBruijn's user avatar
  • 81k

Only top scored, non community-wiki answers of a minimum length are eligible