Re: [users@httpd] Spurious access denied errors

2018-02-13 Thread Marat Khalili
, but the error is still there. Allowing access to DocumentRoot of course solves the problem, but I'm still curious... -- With Best Regards, Marat Khalili - To unsubscribe, e-mail: users-unsubscr...@httpd.apache.or

Re: [users@httpd] Setting up Apache 2.4 with Letsencrypt

2018-02-13 Thread Marat Khalili
Best Regards, Marat Khalili - To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org For additional commands, e-mail: users-h...@httpd.apache.org

Re: [users@httpd] Retry connection to reverse proxy backend

2018-02-11 Thread Marat Khalili
ble or safe to retry. That's going to be a problem when you discuss automating it unconditionally with developers. -- With Best Regards, Marat Khalili - To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org For additional

Re: [users@httpd] Spurious access denied errors

2018-02-09 Thread Marat Khalili
root to a directory you can give access even if it's an > empty directory to get rid of those messages or change the documentoot to > something else. I will do like you advise, but would still like to learn what's going on. --

Re: [users@httpd] Spurious access denied errors

2018-02-09 Thread Marat Khalili
PHP create some internal requests? How can I debug this? -- With Best Regards, Marat Khalili - To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org For additional commands, e-mail: users-h...@httpd.apache.org

[users@httpd] Spurious access denied errors

2018-02-09 Thread Marat Khalili
56622] AH01630: client denied by server configuration: /var/www/html/test If I remove clause, these messages disappear. They trigger fail2ban and are generally confusing. What may be causing them and how to make them stop? -- With Best Regards, Marat Kh

Re: [users@httpd] Probably small problem with SSL config

2018-02-05 Thread Marat Khalili
instead? -- With Best Regards, Marat Khalili - To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org For additional commands, e-mail: users-h...@httpd.apache.org

Re: [users@httpd] Redirect only a specific index.php page to new location

2018-01-25 Thread Marat Khalili
ke you have added some rules while trying to solve your problem, while rest came from default Wordpress installation. I'd leave only default Wordpress ones and see if it solves unnecessary redirects. -- With Best Regards, Marat Khalili

Re: [users@httpd] Redirect only a specific index.php page to new location

2018-01-21 Thread Marat Khalili
ther redirect rule somewhere, e.g. in .htaccess file. -- With Best Regards, Marat Khalili

Re: [users@httpd] Correctly configuring OCSP Stapling cache

2018-01-17 Thread Marat Khalili
g by https://bz.apache.org/bugzilla/show_bug.cgi?id=57121 it is still unfixed, I wonder why too. -- With Best Regards, Marat Khalili - To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org For additional commands, e-mai

Re: [users@httpd] Apache Virtual Host not working properly

2017-12-30 Thread Marat Khalili
> For the second question, for sure it's not the application because I ever use > the same app before but i didn't get the problem [...] Try to set ProxyPreserveHost -- With Best Regards, Marat Khalili - T

Re: [users@httpd] mirror a html site

2017-12-24 Thread Marat Khalili
-- With Best Regards, Marat Khalili - To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org For additional commands, e-mail: users-h...@httpd.apache.org

Re: [users@httpd] Authentication options besides basic

2017-12-22 Thread Marat Khalili
layer above the web server. If you don't like basic authentication, you probably need to implement authentication as part of your Tomcat application. -- With Best Regards, Marat Khalili - To unsubscribe, e-mail: users-uns

Re: [users@httpd] Best practice for restricting access to exact IP addresses

2017-12-01 Thread Marat Khalili
favour creating default virtualhost with dummy name which (among other things) will get shown to bots that don't provide host name or SNI. For instance, it may always return 403. -- With Best Regards, Marat Khalili ---

Re: [users@httpd] Best practice for restricting access to exact IP addresses

2017-12-01 Thread Marat Khalili
which affect all virtual hosts. -- With Best Regards, Marat Khalili - To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org For additional commands, e-mail: users-h...@httpd.apache.org

Re: [users@httpd] Best practice for restricting access to exact IP addresses

2017-12-01 Thread Marat Khalili
conf along with tons of other things. -- With Best Regards, Marat Khalili - To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org For additional commands, e-mail: users-h...@httpd.apache.org

Re: [users@httpd] Best practice for restricting access to exact IP addresses

2017-12-01 Thread Marat Khalili
On 01/12/17 13:42, Marat Khalili wrote: Most likely it is overridden by other Directory or Location or some other kind of block somewhere in your configuration. Try to replace with to be closer to the end of pipeline as described here: https://httpd.apache.org/docs/current/sections.html

Re: [users@httpd] Best practice for restricting access to exact IP addresses

2017-12-01 Thread Marat Khalili
re: https://httpd.apache.org/docs/current/sections.html#merging -- With Best Regards, Marat Khalili - To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org For additional commands, e-mail: users-h...@httpd.apache.org

[users@httpd] On proxy insert header from database using client certificate CN as a key

2017-11-20 Thread Marat Khalili
pache modules? What modules should I look into? (Plan B is to pre-generate Apache config with many If's on %{SSL:SSL_CLIENT_S_DN_CN}, but of course I'd like cleaner solution.) -- With Best Regards, Marat Khalili -

[users@httpd] Update OCSP stapling response in advance

2017-09-18 Thread Marat Khalili
if fresh one cannot be obtained, or will it just fail? (Sorry if discussed earlier, I remember something along these lines, but don't remember of some solution or workaround was found.) -- With Best Regards, Marat Kh

Re: [users@httpd] Permission to enable CGI Scripts to do an I/O on the file system

2017-08-11 Thread Marat Khalili
igure cgitb to create tracefiles in a predefined directory. (Also, typical initial problem with CGI scripts is forgetting to write HTTP headers.) -- With Best Regards, Marat Khalili On August 11, 2017 9:20:19 PM GMT+03:00, Kiorp Pilu wrote: >Hello Marat, > >Thanks for the comment. >

Re: [users@httpd] Permission to enable CGI Scripts to do an I/O on the file system

2017-08-10 Thread Marat Khalili
han just a temporary file then you should consider using database since writing arbitrary files from CGI scripts would otherwise cause concurrency and security problems. -- With Best Regards, Marat Khalili On 11/08/17 00:29, Kiorp Pilu wrote: Hello, I have written a python script that will spit

Re: [users@httpd] graceful restarts

2017-07-31 Thread Marat Khalili
currently auto-renew certificates with a custom script, and apart from restarting Apache it also: * commits changes to etckeeper; * propagates new certificates to other users (SMTP server in my case). -- With Best Regards, Marat Khalili

Re: [users@httpd] Migrate webDAV on IIS to Apache?

2017-07-21 Thread Marat Khalili
-- With Best Regards, Marat Khalili On July 22, 2017 12:06:43 AM GMT+03:00, Todd Blum wrote: >Hello, > >I'm currently have IIS set up to run webDAV. Is it possible to migrate >to >webDAV on Apache instead without losing any data? > >Todd >

Re: [users@httpd] Apache 2.4 access control question

2017-07-19 Thread Marat Khalili
On 19/07/17 02:02, Jason Brooks wrote: The same thing happens if I don’t use a .htaccess file but instead define a section in my apache config. What happens if you try ? -- With Best Regards, Marat Khalili - To unsubscribe

Re: [users@httpd] Re: 'require' directive result

2017-06-20 Thread Marat Khalili
My 2.4.18 already logs AH01797 (client denied by server configuration) to a configured ErrorLog in this case. I don't use syslog myself so I cannot help you with this part, but quick google search shows it is possible in various ways. -- With Best Regards, Marat Khalili On 20/06/17

Re: [users@httpd] Re: Access control to allow local clients or remote with SSL client certificate

2017-06-16 Thread Marat Khalili
certificates as soon as CRL expires. Without these changes you are granting access to any certificate you (or any other CAs specified in SSLCACertificateFile) ever issued, even to unrelated or obsolete ones. -- With Best Regards, Marat Khalili On 16/06/17 12:24, Darren S. wrote: I ended up

Re: [users@httpd] Suggestion/Question about HTTP & HTTPS configurations

2017-05-20 Thread Marat Khalili
iguration does not work this way (what if I don't want either of HTTP or HTTPS vhosts?) * Every HTTPS vhost normally needs some configuration, at least a separate certificate. * Finally, your proposed behavior is not even a good default these days (redirect from HTTP to HTTPS is). -- With B

Re: [users@httpd] TLS1.2

2017-05-17 Thread Marat Khalili
And, for completeness, if your server is public-facing (no pages need to be available, being able to connect is enough): https://www.ssllabs.com/ssltest/ -- With Best Regards, Marat Khalili On 16/05/17 22:04, ANKIT PALRECHA wrote: Hello Team, Any idea how can we test if apache supports

Re: [users@httpd] How to customize error responses (while using mod_rewrite)?

2017-05-15 Thread Marat Khalili
Just in case you are stuck, you can always use internal redirect to a CGI script (or PHP or whatever) and write whatever response you want with that script. It's kind of cheating but it should work. -- With Best Regards, Marat Khalili On May 15, 2017 5:46:52 PM GMT+03:00, Jens Schleu

Re: [users@httpd] Apache 2.4: Proxy certificate configuration question

2017-05-04 Thread Marat Khalili
Sorry, haven't configured it this way; probably someone who did will help. I can only advise you to look into SSLProxyMachineCertificatePath, maybe you could use that. -- With Best Regards, Marat Khalili On 04/05/17 14:54, Markus Gausling wrote: Thanks for response. Maybe I did not

Re: [users@httpd] Apache 2.4: Proxy certificate configuration question

2017-05-04 Thread Marat Khalili
efore other servers). -- With Best Regards, Marat Khalili On 03/05/17 18:11, Markus Gausling wrote: Hello, when Apache is configured as a WebServer I can configure the private key and the certificate of the server separately using SSLCertificateFile and SSLCertificateKeyFile. When configuring A

Re: [users@httpd] XSS Issue in v2.0.59

2017-05-01 Thread Marat Khalili
vely (with some library) usually helps. But it has nothing to do with Apache. -- With Best Regards, Marat Khalili On 02/05/17 06:24, Hagan, Mark wrote: Hello All, Looking for some help to determine if I can configure Apache 2.0.59 to address a couple Cross Site Scripting (XSS) vulnerabilitie

Re: [users@httpd] Problem with Apache2 after upgrade from Ubuntu14.04 to 16.04

2017-04-18 Thread Marat Khalili
With Best Regards, Marat Khalili

Re: [users@httpd] Problem with Apache2 after upgrade from Ubuntu14.04 to 16.04

2017-04-18 Thread Marat Khalili
. Reinstallation of Apache might not even fix this. Moreover, Apache clearly complains on ports being already in use. It'd investigate what uses the ports before doing anything else. It could even be Apache itself (different instance started independently). -- With Best Regards, Marat Kh

Re: [users@httpd] SSLSessionCache file not created

2017-04-13 Thread Marat Khalili
t ssl_scache. I couldn't find deleted handle on ssl_scache in my system. the above file descriptors point inside/run/, not/var/run/ These are probably symlinked. -- With Best Regards, Marat Khalili

Re: [users@httpd] Apache fails to process a particular user-agent

2017-04-10 Thread Marat Khalili
amp;oe=utf-8&gfe_rd=cr&ei=uS7rWO6sGeTk8Ae2ioWYBg#newwindow=1&channel=fs&q=change+user+agent> and check. I doubt anything in your stack checks user agent though, most likely your client works incorrectly (i.e. doesn't process redirects). -- With Best Regards, Marat Khalili

Re: [users@httpd] Apache 2.4 : Rewrite to keep the original URL

2017-03-11 Thread Marat Khalili
r own authentication is not recommended, because it's almost impossible to avoid major security blunders when you do it the first time. -- With Best Regards, Marat Khalili On March 11, 2017 4:07:54 PM GMT+03:00, "Fabio S. Schmidt" wrote: >Hi, > >I'm trying to se

Re: [users@httpd] Forward Proxy on behalf of the client instead of as a tunnel

2017-02-28 Thread Marat Khalili
In your case you'll need rather simple rewrite rule that changes URLs of all requests from http to https, with P option, and that's all. It is hard to say more without doing experiments. -- With Best Regards, Marat Khalili

Re: [users@httpd] Forward Proxy on behalf of the client instead of as a tunnel

2017-02-28 Thread Marat Khalili
the reverse proxy works as >well. > >Thanks for the response. Regarding the original question, is what I am >asking possible? > >-Dan > >On Tue, Feb 28, 2017 at 12:19 AM, Marat Khalili wrote: > >> Why are you calling it _forward_ proxy if it's only go

Re: [users@httpd] Forward Proxy on behalf of the client instead of as a tunnel

2017-02-27 Thread Marat Khalili
Why are you calling it _forward_ proxy if it's only going to connect to one service? Your problem can easily be solved with _reverse_ proxy. -- With Best Regards, Marat Khalili On 28/02/17 02:16, Daniel Frank wrote: All, I am trying to set Apache up as a forward proxy to help sol

Re: [users@httpd] php curl

2017-02-24 Thread Marat Khalili
it appears that get request never gets executed You didn't write what happens. Does your PHP code gets executed at all? One common error is not configuring Apache to recognize scripts in the first place. -- With Best Regards, Marat Kh

Re: [users@httpd] redirect port from 80 to 443

2017-02-20 Thread Marat Khalili
e URL rewrite C (let alone Python) is not yet created. -- With Best Regards, Marat Khalili - To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org For additional commands, e-mail: users-h...@httpd.apache.org

Re: [users@httpd] redirect port from 80 to 443

2017-02-19 Thread Marat Khalili
them. -- With Best Regards, Marat Khalili On 19/02/17 00:33, Spork Schivago wrote: Sorry to butt in here. I've been following this post with some interest. I wanted to accomplish the same thing the original OP wanted to accomplish, redirect all traffic to the secure version of my site.

Re: [users@httpd] SSL_CLIENT_SAN IP addr validation

2016-12-19 Thread Marat Khalili
As additional benefit, when you will be able to issue certificates with regular expressions matching whole subnets! :) -- With Best Regards, Marat Khalili On 19/12/16 20:41, Marat Khalili wrote: Are you suggesting to put the IP address with the DNS prefix instead of the proper IP prefix

Re: [users@httpd] SSL_CLIENT_SAN IP addr validation

2016-12-19 Thread Marat Khalili
_SAN_DNS_3}|%{SSL_CLIENT_SAN_DNS_4}|...)$/" (Missing variables will expand to empty strings). I hope I know it's ugly as hell, but so are client certificates with multiple IP address aliases. -- With Best Regards, Marat Khalili

Re: [users@httpd] SSL_CLIENT_SAN IP addr validation

2016-12-19 Thread Marat Khalili
If you really put IP address in domain subjectAltName and want to verify it, I suppose expression should be something like this: Require expr "%{SSL_CLIENT_SAN_DNS_1} == %{REMOTE_ADDR}" -- With Best Regards, Marat Khalili On 19/12/16 18:48, Andrei Ivanov wrote: Hi, Yes, I did

Re: [users@httpd] SSL_CLIENT_SAN IP addr validation

2016-12-19 Thread Marat Khalili
ess in subjectAltName. What you probably want is accepting clients belonging to particular group. Issue them certificates with the same organizational unit and verify SSL_CLIENT_S_DN_OU as well as SSL_CLIENT_S_DN_O. -- With Best Regards, Marat Khalili On 15/12/16 13:46, Andrei Ivanov wrote: H

Re: [users@httpd] Which config file is fit for my apache2?

2016-11-16 Thread Marat Khalili
ServerName outside VirtualHost mostly has cosmetic effect AFAIU, just put some canonical name of your server there. -- With Best Regards, Marat Khalili On 16/11/16 07:33, 水静流深 wrote: Let's suppose a scene on centos7. - domain name: xyz.com - the domain parsed by third-party dns s

Re: [users@httpd] Install and Configure Apache on Windows Server

2016-11-08 Thread Marat Khalili
ons ? so i can have a look. Well, e.g. if you download Apache for Windows binaries from Apache Haus <https://www.apachehaus.com/cgi-bin/download.plx>, you will find them in /Apache24/conf/extra/ -- With Best Regards, Marat Khalili On 08/11/16 17:38, Robert Ramoutar wrote:

Re: [users@httpd] Install and Configure Apache on Windows Server

2016-11-04 Thread Marat Khalili
sample site configurations (i.e. default-ssl.conf), just read them. Cannot help you with Tomcat, sorry. Saw it last time in 2004. -- With Best Regards, Marat Khalili On 04/11/16 16:19, Robert Ramoutar wrote: Hello , Thank you for that explanation. I have been able to generate CSR file

Re: [users@httpd] Install and Configure Apache on Windows Server

2016-11-03 Thread Marat Khalili
Hello Robert, There seems some misunderstanding here. Apache does not generate certificates, nor there's "import" process - you just put files wherever you want and specify their location in configuration. Minimal Apache configuration of site with SSL is less than dozen lines, nothing difficult

Re: [users@httpd] Perl prg RewriteMap always returns blank

2016-10-08 Thread Marat Khalili
Injecting some logging statements into the script (or use wrapper) to see if it actually tries to return something to Apache or not. -- With Best Regards, Marat Khalili - To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org

Re: [users@httpd] Showing exact filesize in bytes instead of shortform in directory listing

2016-10-03 Thread Marat Khalili
On 03/10/16 19:35, Rich Bowen wrote: Or use rsync WebDAV would be more on-topic. -- With Best Regards, Marat Khalili - To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org For additional commands, e-mail: users-h

Re: [users@httpd] TLS Proxy client certificates per virtualhost

2016-09-30 Thread Marat Khalili
ndent using SSLCertificateFile etc. Likewise, remote server CA certificates can be made virtual-host dependent using SSLProxyCACertificateFile etc. -- With Best Regards, Marat Khalili On 30/09/16 17:42, Mark Blackman wrote: Hi, What kind of options do I have if I want to use different SSL

Re: [users@httpd] Unit file of apache2.service changed on disk

2016-09-28 Thread Marat Khalili
This is a message of systemd, not Apache. Either apache2.service file really changes (gets rewritten by something?), or (more likely) it's a bug of systemd. As long as Apache starts successfully and it is not mission critical I would ignore this message. -- With Best Regards, Marat Kh

Re: [users@httpd] Apache: Avoiding users to access 'www.foo.com/subdomain1/'

2016-09-20 Thread Marat Khalili
There's a way to achieve what you ask with mod_rewrite directives in .htaccess, but before trying this, why not point foo.com to a separate directory? -- With Best Regards, Marat Khalili On 19/09/16 21:41, thomas Armstrong wrote: Hi. I have an Apache server, which main rootwebd

Re: [users@httpd] 2.4 named virtual hosts question

2016-09-12 Thread Marat Khalili
RewriteOptions Inherit), all others simply apply to all vhosts. But if I remove my default "deny" virtual host, what changes? That's what I cannot quite get in your explanation. -- With Best Regards, Marat Khalili -

Re: [users@httpd] 2.4 named virtual hosts question

2016-09-12 Thread Marat Khalili
security and availability). Well, for one thing log messages from actual vhosts and from internet scans are separated, this alone saves a lot of time. -- With Best Regards, Marat Khalili - To unsubscribe, e-mail: users-unsubscr.

Re: [users@httpd] 2.4 named virtual hosts question

2016-09-12 Thread Marat Khalili
nd subsequently ban) clients (mostly bots) that do not even know domain name they are accessing? -- With Best Regards, Marat Khalili

Re: [users@httpd] 2.4 named virtual hosts question

2016-09-12 Thread Marat Khalili
Order Allow,Deny Require all denied Works great in pair with fail2ban ;) -- With Best Regards, Marat Khalili On 12/09/16 04:43, Ronald F. Guilmette wrote: A simple question. Sorry if this is an FAQ. I'm just bringing up a fresh VM system that I plan to move my small hand

Re: [users@httpd] SNI SSL per domain?

2016-09-08 Thread Marat Khalili
x27;d cache certificates in memory, not check filesystem every time. It is not hard to type service apache2 reload when you need it. -- With Best Regards, Marat Khalili On 08/09/16 06:04, Felipe Gasper wrote: On 7 Sep 2016, at 9:43 PM, Marat Khalili wrote: Did you consider having two instanc

Re: [users@httpd] SNI SSL per domain?

2016-09-07 Thread Marat Khalili
redundant (in most cases) and error-prone? -- With Best Regards, Marat Khalili On September 8, 2016 3:03:35 AM GMT+03:00, Felipe Gasper wrote: >Reviving this thread … > >This would mean that every vhost will needs its own common.conf file, >which, on a server with thousands of vhost

Re: [users@httpd] httpd session timeout

2016-08-24 Thread Marat Khalili
dentials of every request, there's no session or timeout for HTTP authentication. -- With Best Regards, Marat Khalili On August 24, 2016 4:53:28 PM GMT+03:00, Roger Paanini wrote: >Chris, I am testing it by logging into the website using basic >authentication and then waiting for th

Re: [users@httpd] "localhost/index.php" don't run.

2016-08-21 Thread Marat Khalili
How is PHP configured in Apache? (Is it?) There are several ways to do it, mod_php is probably easiest. -- With Best Regards, Marat Khalili

Re: [users@httpd] 404 rewrite error using special character \

2016-08-18 Thread Marat Khalili
ve accordingly (for instance, fail to reload page on just fragment change). -- With Best Regards, Marat Khalili On August 19, 2016 8:20:28 AM GMT+03:00, elliott sterling wrote: > > >I learned that the error was that it was looking for folder or >directory "/#".

Re: [users@httpd] HTTPD asking for password after power failure

2016-08-12 Thread Marat Khalili
>From what I saw, this behavior of /dev/random is totally normal on an idle >Linux system. Just do not ever use /dev/random. -- With Best Regards, Marat Khalili On July 30, 2016 6:04:42 AM GMT+03:00, Nick Williams wrote: >It took me a while to get back to this (it’s not a mission

Re: [users@httpd] Content negotiation with language subtags

2016-07-15 Thread Marat Khalili
quest from the client. The browser is probably in error in not stating that "de" version is acceptable (likewise for "en"). -- With Best Regards, Marat Khalili On 15/07/16 14:31, Martin Reinders wrote: Im am using content negotiation to present different HTML pages depending on t

Re: [users@httpd] Implement request white list in Apache

2016-07-08 Thread Marat Khalili
You can do this with mod_rewrite: RewriteCond %{REQUEST_URI} !^allowed_url_1$ RewriteCond %{REQUEST_URI} !^allowed_url_2$ ... RewriteCond %{REQUEST_URI} !^allowed_url_N$ RewriteRule .* - [F,L] -- With Best Regards, Marat Khalili On 08/07/16 13:53, Joice Joseph wrote

Re: [users@httpd] Apache listening on UDP ports

2016-07-06 Thread Marat Khalili
Well, you can redirect UDP to TCP with tools like netcat. Not sure what you want to achieve, though. HTTP is mostly stream-oriented IMO. -- With Best Regards, Marat Khalili On July 6, 2016 7:09:22 PM GMT+03:00, Hermes Moraes wrote: >Dear all, > > I'm wondering how to get Ap

Re: [users@httpd] ProxyPreserveHost doesn't work with SSL

2016-07-04 Thread Marat Khalili
27;s gone. Will post again if I see it appear again. -- With Best Regards, Marat Khalili - To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org For additional commands, e-mail: users-h...@httpd.apache.org

Re: [users@httpd] ProxyPreserveHost doesn't work with SSL

2016-07-04 Thread Marat Khalili
On 04/07/16 16:19, Eric Covener wrote: packet capture. Tried to already. Seems like Wireshark cannot decrypt TLS 1.2 exchange with Server Key Exchange part present. -- With Best Regards, Marat Khalili - To unsubscribe, e

Re: [users@httpd] ProxyPreserveHost doesn't work with SSL

2016-07-04 Thread Marat Khalili
On 01/07/16 23:19, Yann Ylavic wrote: On Fri, Jul 1, 2016 at 6:26 PM, Marat Khalili wrote: Is the header Host sent by the proxy different from the one sent by the client (with and without using SSL) or are you talking about the SNI (in the SSL handshake) which is not set when using SSL? I

[users@httpd] ProxyPreserveHost doesn't work with SSL

2016-07-01 Thread Marat Khalili
SSLProxyCheckPeerName off SSLProxyCheckPeerExpire off ProxyPreserveHost on ProxyPass https://10.1.2.3/ connectiontimeout=300 timeout=300 ProxyPassReverse / ProxyPassReverseCookieDomain myapp.com 10.1.2.3 --- -- Wi

Re: [users@httpd] Re: CLOSED - Re: [users@httpd] Macros + Require constructs

2016-06-19 Thread Marat Khalili
On 18/06/16 22:03, John Allen wrote: Interestingly, without the RequireAll around the "Require user %user" it does not work. Sounds like a bug? -- With Best Regards, Marat Khalili - To unsubscribe, e-mail: user

Re: [users@httpd] Change TMP dir

2016-05-24 Thread Marat Khalili
WebClient may do it. -- With Best Regards, Marat Khalili

Re: [users@httpd] Re: Want friendly error message for failed attempt to access a restricted directory

2016-05-11 Thread Marat Khalili
promising. -- With Best Regards, Marat Khalili - To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org For additional commands, e-mail: users-h...@httpd.apache.org

Re: [users@httpd] Re: Want friendly error message for failed attempt to access a restricted directory

2016-05-11 Thread Marat Khalili
With Best Regards, Marat Khalili On 11/05/16 15:28, Tom Browder wrote: On Wed, May 11, 2016 at 7:19 AM, Tom Browder wrote: I am running Apache 2.4.18 and have one site (https://usafa-1965.org) that requires a client certificate to access a restricted directory ("Classmates Only").

Re: [users@httpd] I need to activate a NULL cipher in modssl

2016-05-03 Thread Marat Khalili
Been discussed recently, see https://www.spinics.net/lists/apache-users/msg112140.html (or other browser for this maillist). I still vote for stunnel. -- With Best Regards, Marat Khalili On 03/05/16 16:48, Gaetan Njinang wrote: Hello, Please, I have a problem. I need to activate NULL

Re: [users@httpd] Apache keeping open deleted files

2016-04-18 Thread Marat Khalili
With Best Regards, Marat Khalili On 18/04/16 12:49, David Cunningham wrote: Hi Marat, Thanks for the reply. Do you know why Apache keeps them open? The process shouldn't need to end for the file to disappear - just the file descriptor to be closed. On 18 April 2016 at 16:54, Marat Khali

Re: [users@httpd] Apache keeping open deleted files

2016-04-17 Thread Marat Khalili
with Apache installed, and the output was similar to yours. -- With Best Regards, Marat Khalili On 18/04/16 08:25, David Cunningham wrote: Hi, While reviewing filesystem usage we noticed lots of deleted files still open by Apache, as reported by lsof. Some example lines are below. Can

Re: [users@httpd] Apache with mod_rewrite and mod_proxy doesn't work / P Flag

2016-04-05 Thread Marat Khalili
OOPS, sorry, posted too fast. According to logs RewriteRule does not perform internal redirect. You might try ProxyPass instead. -- With Best Regards, Marat Khalili On 05/04/16 16:17, Marat Khalili wrote: You also need ProxyPassReverse in order to rewrite header URLs from the backend, and

Re: [users@httpd] Apache with mod_rewrite and mod_proxy doesn't work / P Flag

2016-04-05 Thread Marat Khalili
You also need ProxyPassReverse in order to rewrite header URLs from the backend, and probably ProxyPassReverseCookieDomain and ProxyPassReverseCookiePath too. -- With Best Regards, Marat Khalili On 05/04/16 14:01, Rael wrote: Hello, I'm in the process to use Apache as a reverse proxy

Re: [users@httpd] Quick 2.4 Require question

2016-04-01 Thread Marat Khalili
al" seem to have only appeared in documentation to version 2.5. Are you using 2.5 already? -- With Best Regards, Marat Khalili On 01/04/16 12:15, Michael A. Peters wrote: Take the following : AllowOverride None php_value include_path "/srv/cdn/phpinclude" Require local Requ

Re: [users@httpd] Rewrite domain to language specific page but no address bar redirection

2016-03-25 Thread Marat Khalili
ewriteCond %{REQUEST_URI} !^/fr/.*$ RewriteRule ^(.*)$ /fr/$1 [L] RewriteCond %{HTTP_HOST} ^lang-fr\.hostname\.com$ [NC] RewriteRule ^(.*)$ - [L] # fr-lang } Repeat for each language (probably it's possible to make a single rule set for all languages, but I didn't try it). -- With

Re: [users@httpd] Override a File to Same Name in Another Directory

2016-03-13 Thread Marat Khalili
: select parameters set depending on current domain, hard coded or obtained from a database? I'm not saying it'll work for sure, but it's worth a try IMO. -- With Best Regards, Marat Khalili On 13/03/2016 18:25, Ron Wingfield wrote: First, thanks for your quick reply. I suspect

Re: [users@httpd] Override a File to Same Name in Another Directory

2016-03-12 Thread Marat Khalili
that symbolic link or PHP configuration or something in the system. Actual analogue of OVRDBF as I understand it in Linux is OverlayFS, but it's overkill for your task. -- With Best Regards, Marat Khalili On 12/03/2016 23:14, Ron Wingfield wrote: I don’t know if and how this can be ac

Re: [users@httpd] Block access to "OPTIONS *"

2016-02-12 Thread Marat Khalili
I'm sorry to suggest it without myself testing it first, but are you aware of mod_allowmethods? -- With Best Regards, Marat Khalili On 12/02/16 14:47, Yann Ylavic wrote: On Fri, Feb 12, 2016 at 10:47 AM, Daniel wrote: The typical way to block OPTIONS in 2.2 does not need mod_rewrite a

Re: [users@httpd] 回覆︰ [users@httpd] 回覆︰ [users@httpd] How to solve ONE fixed IP serving multiple web-servers running on VMs

2015-12-25 Thread Marat Khalili
Looks ok at first glance. -- With Best Regards Marat Khalili On December 25, 2015 7:17:47 PM GMT+03:00, Stephen Liu wrote: >Hi, Marat, >Whether following document is good for me to follow; >Building Apache for Proxying >http://www.apachetutor.org/admin/reverseproxies

Re: [users@httpd] 回覆︰ [users@httpd] How to solve ONE fixed IP serving multiple web-servers running on VMs

2015-12-25 Thread Marat Khalili
Have no experience with HA Proxy, sorry. Your task can be solved with plain Apache, information about using one as reverse proxy is easier to find. -- With Best Regards Marat Khalili On 25/12/15 18:44, Stephen Liu wrote: Hi Marat, Thanks for your advice. I suppose you referred to HA Proxy

Re: [users@httpd] How to solve ONE fixed IP serving multiple web-servers running on VMs

2015-12-25 Thread Marat Khalili
Reverse proxy running on host may be the answer. It may discriminate sites by domain name and redirect requests to corresponding virtual hosts. -- With Best Regards Marat Khalili On 25/12/15 18:11, Stephen Liu wrote: Hi all, I have following problem: Host Ubuntu 14.04 desktop VMs

Re: [users@httpd] ProxyPass + Redirect

2015-12-16 Thread Marat Khalili
Crude, but what about: ProxyPassMatch "^/foo/(.+)$" "http://localhost:8009/foo/$1"; ? (not sure about + escaping, can be \+) -- With Best Regards, Marat Khalili On 17/12/15 01:34, Christopher Schultz wrote: All, I've got a reverse-proxy in front of Tomcat t

Re: [users@httpd] explicitly including other ciphers for use with https

2015-12-08 Thread Marat Khalili
s to you at all, because you can use stunnel on both sides. -- With Best Regards, Marat Khalili On December 7, 2015 11:39:30 PM GMT+03:00, Ron Croonenberg wrote: >Hello, > >I a building a storage system, using HTTP/HTTPS for ingesting data. > >I would like to use the authentication

Re: [users@httpd] explicitly including other ciphers for use with https

2015-12-07 Thread Marat Khalili
what gives you the suggestion that the user agent or the httpd server would notice any modification of plaintext bytes in transit through a router or other network intermediate? Isn't this authentication is for? -- With Best Regards, Marat Khalili On 08/12/15 08:54, William A Rowe Jr

Re: [users@httpd] explicitly including other ciphers for use with https

2015-12-07 Thread Marat Khalili
Everything *after* that handshake, in cleartext, is open for inspection or for manipulation Are you sure about the manipulation part? Why do you think encryption helps here then? -- With Best Regards, Marat Khalili On 08/12/15 05:30, William A Rowe Jr wrote: On Mon, Dec 7, 2015 at 7:40 PM

Re: [users@httpd] Architecture recommendations, tips, hints and help

2015-11-29 Thread Marat Khalili
<https://ef.gy/fastcgi-is-pointless> is an easier and safer way than building Apache module. JSON or not depends on data you have; it's ok for small independent records. -- With Best Regards, Marat Khalili On 29/11/2015 16:12, Torge Riedel wrote: Dear list, I'm faced wi

Re: [users@httpd] Persistent proxied connections with Apache 2.4.x?

2015-10-22 Thread Marat Khalili
ny side. If SharePoint follows any standards, that is. -- With Best Regards, Marat Khalili On October 22, 2015 7:28:20 PM GMT+03:00, o haya wrote: >Hi, >We want to use Apache 2.4.x to proxy through to some SharePoint >instances using NTLM logins.  From testing, it looks like th

Re: [users@httpd] VirtualHost configuration not working?

2015-09-30 Thread Marat Khalili
TTP too, no need to configure SSL part). -- With Best Regards, Marat Khalili On 29/09/15 21:07, Felix Rubio Dalmau wrote: Hi Marat, httpd-users :) I have updated the configuration of my apache. Following these lines there is the updated version. The behavior now is: a) If I type in the url box

Re: [users@httpd] VirtualHost configuration not working?

2015-09-29 Thread Marat Khalili
but I don't think it causes your issue.) -- With Best Regards, Marat Khalili On 29/09/15 15:49, felix rubio dalmau wrote: Hi, No, the reason is that site2 holds a cardav server, that is accessed by other of the sites on the same host. The idea behind this is that I can save all the tim

Re: [users@httpd] VirtualHost configuration not working?

2015-09-28 Thread Marat Khalili
Hello, 127.0.0.1 is only configured for site2 -- is it a bug or a feature? Are you testing it from the same host, or via proxy on the same host? -- With Best Regards, Marat Khalili On September 28, 2015 10:06:04 PM GMT+03:00, Felix Rubio wrote: >Hi everybody :-) > >I have an Apac

  1   2   >