Re: limit_req per subnet?

2017-01-02 Thread Grant
ts of the connecting ip address. > > (You'll want to confirm whether "dot" matches "any byte" in your regex > engine; or whether you can make it match "any byte" (specifically > including the byte that normally represents newline); before you trust > that fully, of course.) That sounds like a good solution. Will using map along with a regex slow the server down much? - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: limit_req per subnet?

2016-12-30 Thread Grant
> > So I'm sure I understand, none of the functionality described above > exists currently? Or can it be configured without hacking the nginx core? - Grant >> The exact thing that you want, probably does not exist. >> >> The tools that are needed to

Re: limit_req per subnet?

2016-12-29 Thread Grant
reate something using "geo". Perhaps you want "the first > three bytes of $binary_remote_addr". Perhaps you want "the remote ipv4 > address, rounded down to a multiple of 8". Perhaps you want something > else. So I'm sure I understand, none of the funct

Re: limit_req per subnet?

2016-12-28 Thread Grant
t would mean rewriting some of the functionality of my backend. I'm looking for something that can be implemented independently of the backend, but that doesn't seem to exist in nginx. - Grant ___ nginx mailing list nginx@nginx.org http://mai

Re: limit_req per subnet?

2016-12-15 Thread Grant
ps requests by UA will require too much human monitoring. - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: limit_req per subnet?

2016-12-14 Thread Grant
y, is there a way to limit rate by UA on the fly? If so, can I do that and somehow avoid limiting multiple legitimate browsers with the same UA? - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: limit_req per subnet?

2016-12-14 Thread Grant
> I rate limit them using the user-agent Maybe this is the best solution, although of course it doesn't rate limit real attackers. Is there a good method for monitoring which UAs request pages above a certain rate so I can write a limit for them?

Re: limit_req per subnet?

2016-12-14 Thread Grant
great for a single IP attacker, but all it takes is 3 IPs for an attacker to triple his allowable rate, even from sequential IPs? I'm surprised there's no way to combat this. - Grant >> Did you see if the IPs were from an ISP? If not, I'd ban the service using >> the

Re: limit_req per subnet?

2016-12-14 Thread Grant
> I am curious what is the request uri they was hitting. Was it a dynamic page > or file or a static one. It was semrush and it was all manner of dynamic pages. - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/li

Re: limit_req per subnet?

2016-12-14 Thread Grant
ch CPU work is still done prior to ignoring the request. (I > don't recall the details exactly, but there is a thread I started on the > topic in this list.) Better to block via the firewall since you will be > running one anyway. It sounds like limit_req in nginx does not have any

limit_req per subnet?

2016-12-13 Thread Grant
I recently suffered DoS from a series of 10 sequential IP addresses. limit_req would have dealt with the problem if a single IP address had been used. Can it be made to work in a situation like this where a series of sequential IP addresses are in play? Maybe per subnet? - Grant

Re: keepalive upstream

2016-10-15 Thread Grant
s anyone know why this isn't a default? - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: location query string?

2016-10-04 Thread Grant
does upstream do something > wrong when Keepalive is or is not set? (If there is an nginx problem, > I suspect that people will be interested in fixing it. If there is an > upstream problem, then possibly people there will be interested in fixing > it, or possibly

keepalive upstream

2016-09-30 Thread Grant
I've been struggling with a very difficult to diagnose problem when using apache2 and Odoo in a reverse proxy configuration with nginx. Enabling keepalive for upstream in nginx seems to have fixed it. Why is it not enabled upstream by default as it is downstream? -

Re: proxy_set_header Connection "";

2016-09-30 Thread Grant
send its own Connection > header as appropriate. That makes perfect sense. Is there a way to test if keepalive is active between nginx and the upstream server? - Grant >> Does anyone know why this is required for upstream keepalive? >> >> - Grant

proxy_set_header Connection "";

2016-09-30 Thread Grant
Does anyone know why this is required for upstream keepalive? - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: location query string?

2016-09-30 Thread Grant
stat -ant | awk '{print $6}' | sort | uniq -c | sort -n I could watch for the TIME_WAIT row getting too large. - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

location query string?

2016-09-28 Thread Grant
Can I define a location block based on the value of a query string so I can set a longer timeout for certain form submissions even though all of my form submissions POST to the same URL? - Grant ___ nginx mailing list nginx@nginx.org http

Re: nginx reverse proxy causing TCP queuing spikes

2016-09-28 Thread Grant
ssues. I don't actually need 60m but I do need up to about 20m for some backend administrative processes. What is the right way to solve this problem? I don't think I can speed up the processes. - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: nginx reverse proxy causing TCP queuing spikes

2016-09-28 Thread Grant
;proxy_read_timeout 60m;' leaving too many connections open. Can I somehow allow pages to load for up to 60m but not bog my server down with too many connections? - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Speed up initial connection

2016-09-24 Thread Grant
pt on;' a good idea? - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: limit-req and greedy UAs

2016-09-24 Thread Grant
ating too many connections or something similar and bogging things down for my main site which runs in apache2 behind nginx as well. Is there a good way to find out? Stopping the Odoo daemon certainly kills the problem instantly. - Grant ___ nginx mail

Re: nginx reverse proxy causing TCP queuing spikes

2016-09-24 Thread Grant
se. It turns out this issue was due to Odoo which also runs behind nginx in a reverse proxy configuration on my machine. Has anyone else had that kind of trouble with Odoo? - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

nginx reverse proxy causing TCP queuing spikes

2016-09-21 Thread Grant
ey wait for the server-side stuff to execute. I only use the proxy_read_timeout directive on my admin locations and I'm experiencing the TCP spikes and http slowdowns during the exact hours that the admin stuff is in use. - Grant ___ nginx mailing

Re: limit-req and greedy UAs

2016-09-13 Thread Grant
ps protect eg your backend against request floods > from a single IP and any amount of connections. limit_conn protects against > excessive connections tying up resources on the webserver itself. Perfectly understood. Thank you Richard. - Grant __

Re: limit-req and greedy UAs

2016-09-13 Thread Grant
t I'm certain a few posts, perhaps not on the nginx forum, state > incorrectly that the limiting is per individual connections rather than all > the connections in total. ‎ Nice job. Very good to know. - Grant ___ nginx mailing list nginx

Re: Don't process requests containing folders

2016-09-12 Thread Grant
n the cases where they have the same output. But if there > are cases where the difference in output matters, or if the difference > is not measurable, then leaving it as-is is fine. I'm sure you're right. I'll switch to: location / { return 404; } - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: Don't process requests containing folders

2016-09-12 Thread Grant
ithout a second slash", you could do > > location ~ ^/[^/]*$ {} > > but I suspect you'll be better off with the positive match, plus a > "location /" for "all the rest". I want to keep my location blocks to a minimum so I think I should use the f

Re: limit-req and greedy UAs

2016-09-12 Thread Grant
onfig be any different from my limit_req/limit_req_zone config? - Grant > Should I basically duplicate my limit_req and limit_req_zone > directives into limit_conn and limit_conn_zone? In what sort of > situation would someone not do that? > > - Grant

Don't process requests containing folders

2016-09-12 Thread Grant
's the last one before nginx internal takes over: location ~ (^/|.html)$ { } Can I expand that to only match requests with a single / or ending in .html like this: location ~ (^[^/]+/?[^/]+$|.html$) { } Should that work as expected? - Grant __

Back button causes limiting?

2016-09-11 Thread Grant
configured. Has anyone else noticed this? - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: limit-req: better message for users?

2016-09-11 Thread Grant
it isn't the default? Do you remember the directive that will set this and roughly where it should go? - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: limit-req and greedy UAs

2016-09-11 Thread Grant
y duplicate my limit_req and limit_req_zone directives into limit_conn and limit_conn_zone? In what sort of situation would someone not do that? - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: limit-req and greedy UAs

2016-09-11 Thread Grant
r files browsers request? Today: I don't know. Tomorrow: nobody knows. - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: limit-req and greedy UAs

2016-09-11 Thread Grant
necessarily exist. Too many of those requests triggers limiting even though the user didn't do anything wrong. - Grant > Has anyone considered the problem of legitimate UAs which request a > series of files which don't necessarily exist when they access your > site? Requ

Re: limit-req and greedy UAs

2016-09-11 Thread Grant
an attacker (for example) could get around rate limits by opening a new connection for each request? How are the number of connections limited? - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

limit-req and greedy UAs

2016-09-08 Thread Grant
value. What is the right way to deal with this? - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

limit-req: better message for users?

2016-09-08 Thread Grant
Has anyone experimented with displaying a more informative message than "503 Service Temporarily Unavailable" when someone exceeds the limit-req? - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: 301 executes before authentication

2015-10-07 Thread Grant
> In the links provided above, I see one example of Maxim suggesting a 2-steps > solution playing with a returned status code. Wow, that works. I couldn't follow it at first. Thanks! - Grant >> > Rewrites will execute before authentication module handlers run; this is

Re: 301 executes before authentication

2015-10-06 Thread Grant
lit_path_info ^(/munin)(.*); fastcgi_param PATH_INFO $fastcgi_path_info; fastcgi_pass unix:/var/run/munin/fcgi-html.sock-1; include fastcgi_params; } - Grant >>> I have a server block that contains the following: >>> >>> auth_basic "Please log in."; >&

301 executes before authentication

2015-10-05 Thread Grant
I have a server block that contains the following: auth_basic "Please log in."; location = / { return 301 https://$host:$server_port/folder/; } I noticed that /folder/ is appended to the URL before the user is prompted for authentication. Can that behavior be changed

gzip disrupts users?

2015-09-03 Thread Grant
Is there more config I should consider? - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: ssl_dhparam compatibility issues?

2015-05-23 Thread Grant
I don't serve any java apps. Given that, will DHE params larger than 1024 bits affect my compatibility? If so, I believe a DHE of 1024 bits opens me to the LogJam attack, so if I disable DHE entirely will that affect my compatibility? - Grant ___ n

ssl_dhparam compatibility issues?

2015-05-23 Thread Grant
s://wiki.mozilla.org/Security/Server_Side_TLS - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: gzip_types not working as expected

2015-03-14 Thread Grant
this. > > Anyway, an easy way to check if you are missing a mime type on your gzip > list is to open your page with firebug (or similar) enabled and check the > type and size of the particular resource. Just needed to add application/javascript. Thanks guys. - Grant

Re: gzip_types not working as expected

2015-03-11 Thread Grant
script text/css text/plain; > > - Grant Any help here guys? - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

gzip_types not working as expected

2015-03-09 Thread Grant
gzip is not working on my piwik.js file according to Google at developers.google.com/speed/pagespeed/insights. It's working fine on my CSS file. How can I troubleshoot this? gzip on; gzip_disable msie6; gzip_types text/javascript application/x-javascript text/css text/plain; -

Re: Translating apache config to nginx

2014-02-21 Thread Grant
something was probably lost in translation between apache and nginx. It just needed an extra slash. - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: Translating apache config to nginx

2014-02-21 Thread Grant
ould want that set of restrictions. But > if you want it, this is one way to get it.) > >> location ~ ^(?!installer)(\.?[^\.]+)$ { >> deny all; >> } I think the corrected directive is as follows? location ~ ^/(?!installer)(\.?[^\.]+)$ { deny all; } - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

fastcgi caching

2014-02-21 Thread Grant
am_cache_status; fastcgi_pass unix:/run/php-fpm.socket; include fastcgi.conf; } I'm getting "X-Cache: HIT". I tried to set up a minimal config, but am I missing anything essential? Is setting up a manual purge required or wil

Re: Translating apache config to nginx

2014-02-21 Thread Grant
iles not containing a dot or starting with a dot in all locations except installer directory" Should the following accomplish this in nginx? It gives me 403 during normal operation. location ~ ^(?!installer)(\.?[^\.]+)$ { deny all; } - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: Translating apache config to nginx

2014-02-20 Thread Grant
ring things". I'm not very good with regex and I was hoping someone here would see the problem. Does it make sense that this would work in apache but not in nginx? - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Translating apache config to nginx

2014-02-19 Thread Grant
E\.md|composer\.json-dist|composer\.json|package\.xml)$ { deny all; } But this causes a 403 during normal operation: location ~ ^(?!installer)(\.?[^\.]+)$ { deny all; } Why is that happening? - Grant ___ nginx mailing list nginx@nginx.org

Re: Passing Uncontrolled Requests to PHP

2014-02-13 Thread Grant
k from the wiki should mitigate this risk? - Grant >> Does the wiki example mitigate the "Passing Uncontrolled Requests to PHP" >> risk? >> >> location ~ [^/]\.php(/|$) { >> fastcgi_split_path_info ^(.+?\.php)(/.*)$;

Passing Uncontrolled Requests to PHP

2014-02-13 Thread Grant
return 404; } fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; include fastcgi_params; } http://wiki.nginx.org/PHPFcgiExample http://wiki.nginx.org/Pitfalls#Passing_Uncontrolled_Requests_to_PHP If not, I'd like to upda

Re: minimal fastcgi config for 1 file?

2014-02-13 Thread Grant
fastcgi_param SCRIPT_FILENAME /path/to/script.php; > fastcgi_param PATH_INFO $uri; > include fastcgi_param; > } Should the wiki example be switched from fastcgi_param to fastcgi.cfg: http://wiki.nginx.org/PHPFcgiExample Also, PATH_INFO and PATH_TRANSLATE

Re: fastcgi & index

2014-02-13 Thread Grant
> Trivial and correct fix for the problem mentioned on the wiki is > to properly configure php, with cgi.fix_pathinfo=0. I didn't realize the PHP config should be changed for nginx. Are there other important changes to make besides 'cgi.fix_pathi

Re: fastcgi & index

2014-02-13 Thread Grant
per se. Is the example from the wiki a good one to use? location ~ [^/]\.php(/|$) { http://wiki.nginx.org/PHPFcgiExample - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: fastcgi & index

2014-02-13 Thread Grant
nd should be removed: > > location ~ \.php$ { > fastcgi_pass localhost:9000; > # wrong: fastcgi_index doesn't make sense here > fastcgi_index index.php; > include fastcgi.conf; > } In tha

Re: minimal fastcgi config for 1 file?

2014-02-13 Thread Grant
7;t > need SCRIPT_FILENAME customization. I noticed my distro doesn't include any of the following in fastcgi_params and only the first of these in fastcgi.conf: SCRIPT_FILENAME PATH_INFO PATH_TRANSLATED They are all included in fastcgi_params in

minimal fastcgi config for 1 file?

2014-02-12 Thread Grant
Is it OK to use a minimal fastcgi configuration for a single file like this: location ~ ^/piwik/piwik.php$ { fastcgi_pass unix:/run/php-fpm.socket; include fastcgi_params; } - Grant ___ nginx mailing list nginx@nginx.org http

fastcgi & index

2014-02-12 Thread Grant
or, should the index directive be added to the fastcgi wiki? http://wiki.nginx.org/HttpFastcgiModule - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: No authentication prompt with if block

2014-02-08 Thread Grant
} > >if ($invalid_user) { >return 403; >} > >auth_basic ... > > should work, as it will allow empty $remote_user and auth_basic > will be able to ask for authentication if credentials wasn't > supplied. That works great, thank you. Does adding 'map' slow the server down much? - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

No authentication prompt with if block

2014-02-07 Thread Grant
mote_user != "myuser") { return 403; } What am I doing wrong? - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: restrict by IP for some users

2014-02-07 Thread Grant
127.0.0.0/24 1; > } > > server { > auth_basic "This Site"; > auth_basic_user_file htpasswd; > if ($userip = 0) { > return 403; > } > } Interesting solution. I never would have thought of that. I was using an alias t

restrict by IP for some users

2014-02-05 Thread Grant
I'd like to restrict access to a server block to authenticated users. Some of the users should be able to access it from any IP and some of the users should be blocked unless they are coming from a particular IP. How is this done in nginx? -

Hiring a dev: nginx+interchange

2013-12-31 Thread Grant
e to nginx and I need to hire someone to help me interface interchange to nginx. I don't need the interface to include all of the features from Interchange::Link. - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: root works, alias doesn't

2013-10-02 Thread Grant
ould always prefer "root" over "alias" when it is possible. Many thanks Valentin. - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: root works, alias doesn't

2013-10-02 Thread Grant
: > > location / { > root /data/www; > } > > will return "/data/www/favicon.ico". > > But, > > location / { > alias /data/www/; > } > > will work the same way as > > location / { > root /data/www; > } > > or > > location / { > root /data/www/; > } That's true. Is alias or root preferred in this situation for performance? - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: root works, alias doesn't

2013-10-01 Thread Grant
to be no environmental propagation of some $root > variable (which may be wanted by developers to avoid confusion and unwanted > concatenation of values in the variables tree). > $document_root and $realpath_root must be computed last, based on the value > of the &

Re: root works, alias doesn't

2013-09-29 Thread Grant
the server block and I thought I could use alias to avoid specifying the full path again. > http://stackoverflow.com/questions/10084137/nginx-aliaslocation-directive I tried both of the following with the same result: location / { alias webalizer/; } location ~ ^/$ { alias webaliz

nginx + munin + CGI

2013-09-25 Thread Grant
There is a special set of configuration parameters for apache which allow it to work with munin in CGI mode. Has anyone tried getting it to work with nginx? - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

root works, alias doesn't

2013-09-25 Thread Grant
le or directory) /var/www/localhost/htdocs/webalizer/index.html does exist. - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: All webapps behind nginx reverse proxy by port?

2013-09-25 Thread Grant
> I'm thinking of using nginx as a reverse proxy for all of my > administrative webapps so I can keep them under nice tight control. > Is this a good idea? Would you use port numbers to separate each of > them? > > - Grant On second thought, this wouldn't be a

All webapps behind nginx reverse proxy by port?

2013-09-25 Thread Grant
I'm thinking of using nginx as a reverse proxy for all of my administrative webapps so I can keep them under nice tight control. Is this a good idea? Would you use port numbers to separate each of them? - Grant ___ nginx mailing list nginx@ngin

Re: Strange log file behavior

2013-07-18 Thread Grant
part > seems to be about wrong permissions on a log directory, which > result in non-working USR1. It appears you are right. Thank you for clearing that up Maxim. - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: Strange log file behavior

2013-07-18 Thread Grant
> you are right. There is a problem: > > https://bugs.gentoo.org/show_bug.cgi?id=473036 > > Upstream (nginx) accepted the report: > http://trac.nginx.org/nginx/ticket/376 Many thanks Igor! You've saved me a lot of trouble. - Grant __

Re: Strange log file behavior

2013-07-18 Thread Grant
rror_log from when logrotate executes: open() "/var/log/nginx/error_log" failed (13: Permission denied) open() "/var/log/nginx/localhost.access_log" failed (13: Permission denied) open() "/var/log/nginx/localhost.error_log" failed (13: Permission denied) Is someth

Re: Strange log file behavior

2013-07-15 Thread Grant
ug.cgi?id=476720 > > Seems to be upstream bugs (not Gentoo specific). So maybe you are > affected, too? Which logrotate version do you use? I'm on Gentoo also and I think you nailed it. I will watch those bugs. Thank you! - Grant _

Re: Strange log file behavior

2013-07-15 Thread Grant
te >> test -r /run/nginx.pid && kill -USR1 `cat /run/nginx.pid` >> endscript >> } >> >> Does it look OK? > > Make sure paths used in postrotate are correct. The paths are correct. I made some tweaks and I'll report back tomorrow on how it goes. Any other ideas? - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: Strange log file behavior

2013-07-15 Thread Grant
cs/control.html#logs I use logrotate: /var/log/nginx/*_log { missingok sharedscripts postrotate test -r /run/nginx.pid && kill -USR1 `cat /run/nginx.pid` endscript } Does it look OK? - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Strange log file behavior

2013-07-14 Thread Grant
know why these things are happening? - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: munin plugin for nginx

2013-06-18 Thread Grant
> Replace > > [nginx*] > env.url http://localhost/nginx_status > > with > [nginx_*] > user root Thanks! - Grant > my nginx default file > > egrep -v "(^$|^#)" /etc/nginx/sites-enabled/default > server { > listen 80; ## listen for ip

Re: munin plugin for nginx

2013-06-18 Thread Grant
> My config looks like: > > /etc/munin/plugin-conf.d/munin-node > > ... > [nginx_*] > user root > > /etc/nginx/sites-enabled/default I don't have /etc/nginx/sites-enabled/ at all. What kind of stuff is in the default file? I'm on Gentoo. - Grant &

Re: munin plugin for nginx

2013-06-18 Thread Grant
http://localhost/nginx_status > > added to /etc/munin/plugin-conf.d/munin_node > > then > > munin-run nginx_status > > should run just fine. You fixed it! Reducing it to the simplest config that still works, I found that the location /nginx_status block doesn't work with munin inside of any other server block. It only works inside its own server block like so: server { location ~ ^/nginx_status$ { stub_status on; access_log off; allow 127.0.0.1; deny all; } } Is this a munin bug? Thank you! - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

munin plugin for nginx

2013-06-16 Thread Grant
ions: 13 server accepts handled requests 15 15 16 Reading: 0 Writing: 1 Waiting: 12 What could be the problem? - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: Permissions check

2013-05-17 Thread Grant
> I just updated nginx and was warned about permissions. Are these appropriate: > > /var/log/nginx: > drwxr-x--- root root > > /var/lib/nginx/tmp and /var/lib/nginx/tmp/*: > drwx-- nginx nginx > > - Grant Whoops, please make that: /var/lib/nginx/tmp and

Permissions check

2013-05-17 Thread Grant
I just updated nginx and was warned about permissions. Are these appropriate: /var/log/nginx: drwxr-x--- root root /var/lib/nginx/tmp and /var/lib/nginx/tmp/*: drwx-- nginx nginx - Grant ___ nginx mailing list nginx@nginx.org http

Re: SSL default changes?

2013-03-12 Thread Grant
mean browsers, will it prevent SSL from working at all in those browsers or would a browser error appear? - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: "nginx does not suck at ssl"

2013-03-11 Thread Grant
x's link again: https://www.ssllabs.com/ssltest/ I use the following for better performance: ssl_ciphers RC4:HIGH:!aNULL:!MD5:!kEDH; Reference: http://www.hybridforge.com/blog/nginx-ssl-ciphers-and-pci-compliance - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: SSL default changes?

2013-03-11 Thread Grant
ready implemented by all > modern browsers). > > Use of the RC4 cipher is more a workaround than a permanent > solution, and hence there are no plans to make it the default. OK, why not enable SSL session resumption by default? ssl_session_cache shared:SSL:10m; - Grant

SSL default changes?

2013-03-10 Thread Grant
It looks like these changes from default are required for SSL session resumption and to mitigate the BEAST SSL vulnerability: ssl_session_cache shared:SSL:10m; ssl_ciphers RC4:HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers on; Should the defaults be changed to these? - Grant

Re: HTTPS header missing from single server

2013-03-10 Thread Grant
variable, which is described in > http://nginx.org/en/docs/http/ngx_http_core_module.html#variables I should have mentioned that I'm using proxy_pass. I was able to get it working like this: proxy_set_header X-Forwarded-Proto $scheme; - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: IMAP: auth_http

2013-03-10 Thread Grant
t;> already exist? > > It's usually a script written individualy for a specific system. > Some samples may be found on the wiki, e.g. here: > > http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript In that case I request for nginx's imap p

Re: "nginx does not suck at ssl"

2013-03-10 Thread Grant
e from a cipher-pov is > https://www.ssllabs.com/ssltest/ All things considered, do you think it's best to leave ssl_ciphers default? - Grant >> After reading "nginx does not suck at ssl": >> >> http://matt.io/entry/ur >> >> I'm using: >> >> ss

"nginx does not suck at ssl"

2013-03-09 Thread Grant
After reading "nginx does not suck at ssl": http://matt.io/entry/ur I'm using: ssl_ciphers ALL:!aNULL:!ADH:!eNULL:!MEDIUM:!LOW:!EXP:!kEDH:RC4+RSA:+HIGH; Is this a good choice? - Grant ___ nginx mailing list nginx@nginx.org http://ma

HTTPS header missing from single server

2013-03-09 Thread Grant
http://dev.piwik.org/trac/ticket/2073 - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: proxy_read_timeout for an apache location?

2013-03-09 Thread Grant
on at http://nginx.org/r/proxy_pass > > So the answer is "yes you can, but you have to configure it". Got it, thank you. location /for-apache.html { proxy_read_timeout 30m; proxy_pass http://127.0.0.1:8080; } - Grant ___

Re: nginx for images (apache for pages)

2013-03-09 Thread Grant
> nice tutorial! > > didnt you found anything approbiate here? > http://wiki.nginx.org/Configuration I tried some of those but nothing seemed to match my situation as clearly as the one I used. http://kbeezie.com/apache-with-nginx/ - Grant _

Re: proxy_read_timeout for an apache location?

2013-03-08 Thread Grant
t 30m; } Can I pass for-apache.html to apache and wait 30m for it? - Grant ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

  1   2   >