I'm looking to pass the entries to a web form, via Apache, to an external process (listening on a port say 4321) running on the same host as Apache.Is there a way to "coerce" Apache into doing this?
View 1 RepliesI just went with Steadcom's VPS and they are great. I am setting things up and it's going pretty well, I have to dust off my linux/server knowledge that I haven't used in a couple of years.
Anyway I'm creating a virtual host.. I will have about 10 in the end, but right now I only have one domain IP Pointing to my new server. My registrar is NamesDirect.
When I create the virtual host, I can no longer access subdirectories directly. My Virtual Host directory is, say, /var/www/html/newdir
If I try to reach http://www.domainname.com which has been configued as a virtual host, that comes up correctly from the directory /var/www/html/newdir and works fine.
But if I try to reach http://myipaddress/newdir I get a 404 page not found error. Looking at the log, it's trying to reach /var/www/html/newdir/newdir so it's putting in the virtual host redirect even for just hitting the subdirectory directly.
Is this normal? Do I have something configured wrong? I have another domain that I have changed to IP Point to the VPS but until it propogates I won't be able to test having 2 virtual hosts.
Also.. I have not set up DNS on my VPS. I don't really understand it, and IP Pointing has always worked for me when I ran my own server form my home so I was just going to do that. But I wonder if this could be one of the problems.
An user is reporting this error receiving emails:
451 - The server has reached its limit for processing requests from your host
I've searched for this error message but haven't found much info
I have a dedicated box with softlayer and I have noticed at varying times the past few months that with sites we host, sometimes the connection times out (I'll try to access like 5 or 6 sites within 30 seconds or so and they all drop, then a minute later they load fine).
I opened a support ticket and they said it usually has to do with the # of requests Apache can handle, and that this can be modified. They stated they could: "tweak the apache configuration file in this server that can make it possible to handle more requests."
So my question is what should the # of requests be set to? (I'm not sure what it is now, but I assume whatever the default # is).
Server Version: Apache/2.2.22 (Unix)
On our production service, we've been getting numerous malformed POST requests to some of our CGI scripts that are showing up as 500 errors in our logs. They are malformed in the sense that the actual content length doesn't match the Content-Length specified in the request.
Here's the most trivial example I can come up with that reproduces the problem for us:
POST /some_valid_alias HTTP/1.1
Host: example.org
User-Agent: Arbitrary/1.0
Content-Type: multipart/form-data; boundary=---------------------------41184676334
Content-Length: 769
-----------------------------41184676334
In addition to the 500 error in the access log, we see the corresponding error in the error log:
(70014)End of file found: Error reading request entity data
Based on the nature of the POST request and the error response, it does appear that Apache is doing the right thing here.
The POST never actually makes it as far as the script being targeted (/some_valid_alias in the above example); in other words, Apache returns 500 to the client, writes the error to the error log and never executes the script.
Is there a way to capture/avoid internal Apache errors like 70014, and return some other HTTP status besides 500 (like 403)? It's particularly annoying in our case, because our server sends us an email for all 500 errors.
So far, our best "defense" against these 500 errors is to disallow POST for these aliases, which normally just ignore the POST data anyway (when the request is not malformed):
RewriteCond %{REQUEST_METHOD} ^POST$
RewriteRule ^/(some_valid_alias)(.*)$ $1$2 [R]
But this won't work for all our scripts, because in some cases we do want to permit POST.
I have been experiencing a lot of Keepalive requests for a particular image on a particular domain. please see the lines below.
0-11233931/63/63K 0.15100.40.030.03 195.68.185.13mydomain.comGET http://mydomain.com//images/logo.jpg HTTP/1.1
1-11233941/77/77K 0.18100.40.050.05 122.164.58.63mydomain.comGET http://mydomain.com//images/logo.jpg HTTP/1.1
2-11233951/42/42K 0.76000.40.170.17 89.139.214.74mydomain.comGET http://mydomain.com//images/logo.jpg HTTP/1.1
3-11233971/57/57K 0.04000.40.020.02 82.199.98.229mydomain.comGET http://mydomain.com//images/logo.jpg HTTP/1.1
4-11233981/46/46K 0.27000.40.040.04 217.150.55.41mydomain.comGET http://mydomain.com//images/logo.jpg HTTP/1.1
These are just a few lines from the top.
How can i prevent this from happening.. it seems as a SYN Flood, or maybe a DDoS.
We have an Apache acting as a reverse-proxy and listening on the Internet ("Our URL" on port 443).
We would have two ways of accessing this reverse-proxy:
-From a mobile app (authentication would be based on a corporate certificate)
-From any browser (authentication would be a login form)
The question is: can Apache forward requests to either server 1 or server 2, depending on whether a certificate is sent by the client?
I have Apache 2.4.2, OpenSSL/1.0.1c, on Windows Web Server 2008 R2 (64 bits)
After 12 hours of heavier load, the SSL requests stopped working/being answered. However if you requested the same page via http instead of https, it worked fine. Restarting the Apache server fixes this, for a while. Again after a few hours of traffic, the https requests stopped working again. I checked the logs, and nothing notable, the mod_ssl entries just...
The site is called only by client developed with Delphi 2007 (CodeGear user-agent). Delphi client use THTTPRIO for sending HTTPS request to SOAP.
So I just upgraded Apache 2.2.22 to Apache 2.4.3 and made sure to go through all the options that had changed and update the conf file accordingly. This included adding the cache module for SSL and changing the SSLMutex option over to Mutex default ssl-cache. We also turned off SSLCompression due to the CRIME attack vulnerability.
We use apache strictly as a loadbalancer to 2 tomcat servers via mod_jk. Apache serves no static content at this time.
After being deployed, everything worked fine until later in the day. After 3 hours of heavier load (our site only takes significant traffic during business hours), the SSL requests stopped working/being answered. However if you requested the same page via http instead of https, it worked fine.
Restarting the Apache server fixes this, for a while. Again after a few hours of traffic, the https requests stopped working again. This time I turned the loglevel up to debug and restarted the Apache server.
As traffic slowed down it took another 6 or 7 hours before SSL requests stopped working again. I checked the logs, and nothing notable, the mod_ssl entries just... stopped. (I don't know for sure its ammount of traffic related, it just seems that way)
I have tried reproducing this in a lab, but have not been able to get it to happen on the lab server.
OS: Windows Server 2008 R2
Apache: 2.4.3 vc9 build with OpenSSL 0.9.8 downloaded from apachelounge.org
Mod_JK Version 1.2.37 vc9 also downloaded from apachelounge.
I've spent the last several months working on a huge upgrade of a couple dozen websites. The upgrades include modifying Apache so that visitors who arrive at links pointing to mysite/World/New_York are redirected to mysite/world/new-york. In other words, all my links now default to lower case, and underscores are replaced with dashes.
Unfortunately, publishing it has been an endless series of disasters. My websites are now all crashed, and the server is unbelievably slow. It takes pages forever to load (if they load at all), and I can scarcely publish files online.So the following notice sent to me by my webhost got my attention.
IT appears your own server IP is making GET requests to Apache, causing excessive loading and causing service failures. On today's date, your IP made almost 6,000 connections to Apache:<br><br>
[root@host ~]# grep 64.91.229.106 /usr/local/apache/domlogs/mysite.org | wc -l 5924 [root@host ~]#<br><br>
These were all the same request:<br><br>
64.91.229.106 - - [12/Apr/2014:08:10:10 -0400] "GET /404.php HTTP/1.0" 200 14294 "-" "-"<br><br>
And that made up the total of requests:<br><br>
[root@host ~]# grep 64.91.229.106 /usr/local/apache/domlogs/mysite.org | grep "GET /404.php HTTP/1.0" | wc -l 5924 [root@host ~]#<br><br>
I have a little problem (on my Raspberry) with the maximum concurrent connections.When I open multiple tabs of a webpage which keeps persistent connections, apache is unable to serve more requests.Here is the (shortened) mod_info output (which also takes some time till there is a process kind enough to serve the request):
Code:
Server Version: Apache/2.4.10 (Raspbian) OpenSSL/1.0.1k
Server MPM: prefork
5 requests currently being processed, 9 idle workers
.___W____WWW_..W_...............................................
................................................................
......................
Srv PID Acc M CPU SS Req Conn Child Slot Client VHost Request
[Code] ....
When I understood it correctly, apache should spawn new processes (up to MaxRequestWorkers=150)
But there are idle???? processes, so it wont add new ones?
I dont think it has to do with mod_proxy (used for the webpage) since the mod_info output is affected as well...
We'd like to host an application that will be controlled through web access at a specific port. We also want to control the amount of data traffic on a per user basis.
How can we do this? Can we bind a specific server IP : Port to a user and control the data from that. How can we make sure that only one user access one server IP and Port and so cancel user overlapping (one user finds out another IP and Port and uses that).
We will be using Windows Server 2003 and can have Plesk Control Panel installed.
My [new] host doesn't offer custom DNS records. Obviously, this upsets me somewhat as I need some custom DNS records (mainly A Records).
Would this be possible:
I've got a few servers with SoftLayer. If I pointed my domain to SoftLayer's nameservers and handled the DNS there, could I simply forward everything to their servers from SoftLayer's "Manage DNS" (such as www, mail, ftp, etc), then create the custom DNS myself? Would this work?
Hope that's clear enough to understand!
If not, is there another possible work-around? I need custom A Records!
A weird thing happents once on few days on my server, and it's not a regular thing or on exact time.
When I have this problem no page can be loaded in the browser, but WHM is working, i think because it's accessed by IP .
In apache status page I can see lots of ..reading.. requests which are there even for 10 - 20 seconds sometimes.
Usualy the server has 10 - 20 requests/s :
CPU Usage: u35146 s2297.05 cu2.74 cs4.5 - 6.97% CPU load
11.2 requests/sec - 83.0 kB/second - 7.4 kB/request
10 requests currently being processed, 8 idle servers
But when the ..reading.. requests appear it goes much higher like 100 to 200
11.5 requests/sec - 85.3 kB/second - 7.5 kB/request
200 requests currently being processed, 0 idle servers
after 3 minutes :
160 requests currently being processed, 30 idle servers
When I logged on to SSH I saw that there are ~150 conection from a single IP .
I have an Apache Server (2.4.3) and a Tomcat Server (7.0.36) and have some Java Applications deployed.Everything works fine, but when we start a quite long Ajax process, I see in my Java Application, that a Ajax request is received and starts processing - everything fine. But during processing of the first request, I see a second request starts after 5 minutes.
View 1 Replies View RelatedI currently have a web VPS hosted with FDCServers.net and after 5 days of switching to it i am getting massive HTTP requests. When i login to WHM and hit apache status i have many requests per second by multiple IP's that are going to pages that simple don't exist. Currently my hostname for the server is set at web-01.optical-hosting.com which is what the requests are being sent to. I am also having a DNS issue because when i put http://web-01.optical-hosting.com in the web browser it displays the first account's site under "list accounts" in cpanel. Can someone please help me fix both of these issue's? i will post an apache log in a second post as it is long. Also, these are from overseas. please someone help me with this i have Aim and Msn.
View 4 Replies View RelatedMy Linux Server's Http Daemon (Apache) would stop serving websites ever so often, as soon as apache is restarted the error fixes iteself only to resurface within few hours.
The apache process would still be running i.e. apache does not die but no websites hosted on my server would be accessible from browser. And when this happens the apache logs do not log any http requests.
Instead when this happens all http requests to my server would be redirected to some weird Trojan website and my Norton Antivirus would show an Alert/Warning, for example;
"Browser exploit at www.xxx.xxx was blocked"
Risk Name: MSIE WebViewFolderIcon ActiveX Control BO
or another error like;
"Auto-Protect has detected Trojan.Fakeavalert".
At first i thought the problem could be with my Laptop/ISP so i logged on to the server via SSH and opened try to open a website using command line "lynx mywebsite.com" and it shows following error;
"Alert!: HTTP/1.0 503 Service Unavailable".
Now if i assume my laptop were to be infected, then as soon as i restart my apache and visit mywebsite.com eveything returns to normal with no such warnings. Why do i see those norton error messages only when apache is down with 503, and when apache is down with 503 how come the http requests always get redirected to some suspicious websites and nothing gets logged in apache error log?
I think my server is being attacked causing http to get unresponsive and thereafter http requests to my server are redirected to some malicious website, is this correct?
Also, i suspect this is a php script exploit as some customers have reported that google have blocked their website due to security reasons, i found <iframe> tage inserted in some php pages which i fixed.
Also, another thinh i noticed;
when apache responds with the 503 it is referencing PHP 5.1.4 in the header response:
[root@]# curl -I xxx.xxx.xxx.xxx (my server ip)
HTTP/1.0 503 Service Unavailable
Server: Apache
X-Powered-By: PHP/5.1.4
Retry-After: 20
I am running PHP 4.3.9m why does apache responds with PHP 5.1.4 when this 503 error surfaces?
Also, since my apache was dowan with 503 error a customer mailed in today saying;
"It seems that my site www.xxxx.com is regularly down, and the winlogon virus is involved."
I suspect this is again due to the fact that http requests start getting redirected?
So I've got a problem where a small percentage of incoming requests are resulting in "400 bad request" errors and I could really use some input. At first I thought they were just caused by malicious spiders, scrapers, etc. but they seem to be legitimate requests.
I'm running Apache 2.2.15 and mod_perl2.
The first thing I did was turn on mod_logio and interestingly enough, for every request where this happens the request headers are between 8000-9000 bytes, whereas with most requests it's under 1000. Hmm.
There are a lot of cookies being set, and it's happening across all browsers and operating systems, so I assumed it had to be related to bad or "corrupted" cookies somehow - but it's not.
I added "%{Cookie}i" to my LogFormat directive hoping that would provide some clues, but as it turns out half the time the 400 error is returned the client doesn't even have a cookie. Darn.
Next I fired up mod_log_forensic hoping to be able to see ALL the request headers, but as luck would have it nothing is logged when it happens. I guess Apache is returning the 400 error before the forensic module gets to do its logging?
By the way, when this happens I see this in the error log:
request failed: error reading the headers
To me this says Apache doesn't like something about the raw incoming request, rather than a problem with our rewriting, etc. Or am I misunderstanding the error?
I'm at a loss where to go from here. Is there some other way that I can easily see all the request headers? I feel like that's the only thing that will possibly provide a clue as to what's going on.
I have been trying to solve a big problem for the last 2 weeks with one of our servers.
The client using our system (web based w/ apache and php) is a contact center firm. They have about 120 operators, all connect to our websever with the same IP.
We have been suffering DoS attacks from some of these operators. This are simple, browser attacks , namely 5 or 10 operators will just hold F5 key and bombard the server with requests when they shouldnt.
We did manage to produce a php protection which will recognize the multiple requests and blacklist the user, but its "too late" because the request have already been sent and processed by the webserver.
We use the user ID in the system to control who should be blacklisted, so this is all dependent on our own authentication.
Ideally, we need something EXACTLY like mod_evasive, but for rejecting single requests instead of blocking the IP. Exemplifying : if a user calls the same url, 5 times, in a 3 second spawn, we will reject every next request for 30 seconds, but only the requests by that user.
If the webserver can make any use of it, the user id is stored in a cookie.
I'm running Apache 2.4.4 on Windows Server 2008 R2. It's already happened many times that Apache stopped responding to requests. The last entry in the error.log:
[Wed Mar 27 06:22:07.043600 2013] [mpm_winnt:notice] [pid 1736:tid 256] AH00354: Child: Starting 64 worker threads.
[Wed Mar 27 06:52:34.521200 2013] [mpm_winnt:error] [pid 1736:tid 1656] AH00326: Server ran out of threads to serve requests. Consider raising the ThreadsPerChild setting
Has anyone experienced those sneaky AdSense serving custom error pages from his/her hosting company?
I have seen 1&1 doing it.
Description :
- Windows 2008 server
- Apache 2.4 into a DMZ
What I did in HTTPD.CONF file :
comment #Listen 80
UNcomment following lines
-LoadModule proxy_module modules/mod_proxy.so
-LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
-LoadModule proxy_http_module modules/mod_proxy_http.so
-LoadModule rewrite_module modules/mod_rewrite.so
-LoadModule ssl_module modules/mod_ssl.so
-Include conf/extra/httpd-ssl.conf
-LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
I did also create a self sign SSL certificate.
From the WAN, users will connect with such an URL .... This URL can be resolved from DNS.
What i try to do :
The Apache server must be configure to accept connection only from the ip address of the FW
The apache server must act as a Reverse Proxy and redirect the URL to an internal server with URL ....
Of course, external peoples should only see the url they input to connect.
I'm trying to prevent unnecessary GET requests from being processed by my CMS that originate from mutating IP address locations. This is sucking up server resources when the request is processed by the app, and so if possible, I'd like to block them with HTACCESS so that the request is stopped before anything is intensively-processed.
What happens is that an IP address will make a GET request for, say, "blah/test" or "blah/test2" but nothing else (no site assets like images or CSS/JavaScript files or even other pages). After this request, another IP address will then make an equivalent kind of request, and so on, and so on... All of them have similar if not identical user agent strings but they're always worthless requests that do nothing but waste CPU and RAM. I'm assuming it's just some idiotic SPAM bot because of this.
Ive recently installed installed and configured stuff on my new box but after, I realised abnormal memory usage.
Mysql server is taking 256mb, there are somewhere between 6 and 10 apache process taking up at least 40mb each.
Furthermore, when I do: top, I see that the memory usage is increasing by about 120ko each 3 sec.
I am running centos 5.1 and have a load of 0. Basically, there is no one on the server appart from me.
On the server I have at home running debian, I run all thoose thing and it take up 200mb
max.
13438 nobody 15 0 42276 22m 13m R 22 2.2 1:51.94 httpd
10620 nobody 16 0 41928 16m 8468 S 19 1.7 0:28.54 httpd
11397 nobody 15 0 41524 12m 4784 S 18 1.3 0:06.04 httpd
10745 nobody 15 0 42376 14m 5316 S 17 1.4 0:06.62 httpd
The values in bold are the CPU percentage taken up by each apache process.
So i had to need to each apache process,who can i reduce it?what config i have to change to reduce it?
I've been asked to put an Apache Reverse Proxy in place as per guidance from SAP - [URL] - but have come across an issue where the CSS file is not rewritten by the reverse proxy. The below is the Virtual Hosts entry from the test httpd.conf that i'm running to get it working. I'll be moving this to vhosts entries when it eventually works (optimism slowly vanishing! ).
Listen 443
<VirtualHost *:443>
SSLEngine On
SSLProxyEngine On
ProxyRequests Off
ProxyPreserveHost On
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
AllowEncodedSlashes On
SSLCertificateFile /Apache24/conf/FILE.crt
SSLCertificateKeyFile /Apache24/conf/KEYFILE.key
SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
ServerName Gateway.External.co.uk
ProxyPass / http://SAPGateway.Internal:8010/ nocanon
ProxyPassReverse / http://SAPGateway.Internal:8010/
ErrorLog "C:/Apache24/logs/error.log"
TransferLog "C:/Apache24/logs/access.log"
</VirtualHost>
Each post I come across with a similar issue mentions the trailing '/' on the ProxyPass entries, unfortunately - for me - they're there!
I have a website on domain x like https://example.com. One of our customers want to use their own domain name in the address bar and redirect to our web application. In the control panel of the customers website, we can forward the site to our domain without issues (stealth forwarding). After that, we are able to see the site and navigate to some options. But there are some issues/limitations. I cannot open some links, or click on tabs. The login feature works for chrome but not for internet explorer. Is this due the jump of http to https within an iframe? Or is it related to CORS? I have a Windows 2008 R2 server with Apache, which is the frond-end for the tomcat instances. "Tomcat Apache" serves our Java-based web application (mod_jk binded) ...
View 2 Replies View RelatedI have server in LT, the network is so good, but i got problem with the apache, it keep going down because the process too high ( i think)
when i list the process it show me :
nobody
0.000.250.0 Top Process%CPU 98.9/usr/local/apache/bin/httpd -DSSL Top Process%CPU 98.8/usr/local/apache/bin/httpd -DSSL Top Process%CPU 2.9
Other than that all domain only use not more than 10% process, I use Cpanel X and Cpanel XP skin, please help
Now my domain , will get blank page when try to access, i dont know why, even though all service is running and i already reboot the server
I am in a bind with Apache's multi process limit. Let me explain what I am doing. There's this website which has career details of all the football players since the beginning of professional football. They have a simple web form which allows you to look at a player's profile by entering his name or his 7 digit numeric id number (on that website).
One of my client wants a list of all the players with a certain "flag" in their profile. So I created an automatic form submission and HTML parsing script to get details of all the players with that "flag" in their profile. Let me not go into too much details and tell you that after applying a few pattern rules to the id number, the number of possible id numbers comes to about 1 million (instead of 10^7; each field can have {0,1,2,3,4,5,6,7,8,9}=10 digits, so net combinations = 10*10*10*10*10*10*10).
Therefore, to completely automate this process I wrote a script which would generate an id number, submit the form with that id number, and parse the resulting HTML profile for the "flag". If the script finds a hit on the flag, it stores all the fields of that player in a database. This script is working absolutely fine but the speed I was getting was about one check per second which means that I would have to leave the script running for about 11 days (to process all of about 1 million checks).
So i came up with this idea to divide the check into ten parts and i created separate scripts for each part. Now basically the first script checks for the first 100 thousand combinations, the second checks for another 100 thousand combinations, and so on.
The problem is that I am able to get only two of these scripts running at the same time. So it would still take me at least 5 days to get all the results. The rest of the scripts just sit there in the server's backlog. This is definitely due to Apache's limitation to handle multiple processes. The server I am using to run this script as well the target webserver both run on Apache2. I am sure it's not a problem with the receiving server. It has to be my Apache web server which is running the scripts. I have tried using mpm_winnt (on a windows server) as well as the prefork and worker modules (on a linux server) without any luck. Has any of you ever faced the same situation?
For those concerned about the legitimacy of this work, rest assured, this is absolutely legit. There's nothing in the website's use policy which restricts somebody from doing this. Moreover, my client hired me to do this only because the website owners were not able to hand over the data he required. They gave the stupid reason that they are helpless in providing the data because they don't have a system in place which would allow them to do a search restriction!
I recently switched from XAMPP to a self-setup WAMP installation using Apache Lounge's 2.4.9 package in order to improve performance, to have more tweaking possibilities and to solve some problems that I was not able to solve in XAMPP (e.g. creating large PDF files using TCPDF) on my local Windows 7 development PC.PHP is running as FCGI module, which I thought was a good idea to achieve good performance, but I am afraid I have messed up the configuration a bit.
What happens is that sometimes, PHP script requests do not seem to terminate(?), but I do neither know why, nor do I know what is happening. It probably has something to do with scripts that process kind of a larger