Tag Info

Hot answers tagged

9

I'm not familiar with Linode, but all you need to do is point all the domains to server's IP address and leave the remaining for Apache Name-based Virtual Host handle, something like this: NameVirtualHost *:80 <VirtualHost *:80> ServerAdmin ... DocumentRoot /var/www/html/magento ServerName magentosite.com ServerAlias ...


6

You're looking for a Geoloction (Geoblocking) database which would give you access to the typical IP ranges for the countries you need to block. This is not absolute or completely trustworthy information though. Country level geoblocking is mostly effective but anything like city/state/zip code level information should be treated with great caution. I've ...


5

You're correct. RED implemented the requirements from HTTPbis http://tools.ietf.org/html/draft-ietf-httpbis-p4-conditional-18#section-4.1. Normally, HTTPbis requirements are backwards-compatible with RFC2616 (i.e., they don't make implementations that were conformant to 2616 non-conformance now), but this change slipped through -- we'll be opening an issue ...


4

Regarding your second question: ::1 is localhost in ipv6. Regarding your third question: # Mark requests for the robots.txt file SetEnvIf Request_Method "^OPTIONS$" dontlog # Log what remains CustomLog logs/custom.log common env=!dontlog see also http://httpd.apache.org/docs/2.4/logs.html#accesslog


4

From here It's Apache polling its child processes to verify they're responding correctly. 31-2 - 0/0/44 . 0.00 41 0 0.0 0.00 0.92 ::1 mxx1.xx.com OPTIONS * HTTP/1.0 The second field, " - ", shows that this isn't an active connection.. It's the last connection that took place for this particular thread/process. Since Apache polls ...


4

You need to setup DNS on bluehost or some other DNS hosting service to point to your internal IP. If you have a dynamic IP address, you may want to look at a dynamic DNS solution such as DynDNS. After you have DNS setup, you will setup Apache to serve pages for that domain. Look into name based virtual hosting which will make it easier to setup a second ...


4

Probably the server doesn't recognize the script as executable, and that's why it offers it as a downloadable file. These lines should be present in your Apache config. Note that the path may need to be changed for the .so modules, depending on your configuration: *nix: # -- if you're using PHP 5, uncomment this line to activate it LoadModule php5_module ...


4

Try with the netmask instead of the CIDR notation: <Limit GET POST> order deny,allow allow from 37.18.184.0/255.255.252.0 ... allow from 37.77.172.0/255.255.252.0 deny from all </Limit> Alternatively do it like this: <Limit GET POST> order deny,allow allow from 37.18.184. allow from 37.18.185. allow from 37.18.186. allow from 37.18.187. ...


4

Best way is use some existing of Apache-GeoIP tools (or modules) mod-geoip (example for Debian) MaxMind GeoLite Country (usage - Getting Visitor's Country with PHP using Geo IP)


4

The point is to get the browser to cache resources your site uses wherever possible, as this reduces either HTTP requests or data transferred, both of which help speed. You do this either by setting Expires headers, which tell the browser to cache the resource until the specified time; or by using Last Modified / Etags, which give the browser a way to work ...


4

You really need to identify how the attacker got in. If it was through the webserver, it's actually relatively easy: Determine when the files disappeared. You've already put the files back, so we can't look at the directory's modification time. Instead, look to the webserver logs for 404 errors from those files. Determine what requests came into the ...


4

Presumably you just need to block HTTP access (return an HTTP status code of 403 - Forbidden) to these folders, if stored in the document root? In your document root .htaccess file: # Block HTTP access to certain folders RewriteRule ^classes/.* - [F] RewriteRule ^templates/.* - [F] (...and build flexibility into your framework to allow your framework to ...


4

I think I see your problem. You are adding an extra question mark in your rewrite rule. RewriteRule ^(.*)$ index.php?/$1 [L] Should be RewriteRule ^(.*)$ index.php/$1 [L] based on the example urls your provide. http://laravel.lar/index.php/about/ doesn't have a question mark in it after index.php It is also possible that mod_rewrite is not enabled. ...


4

How do I capture the POST part of incoming HTTP requests for analysis? Try using ModSecurity - from its documentation on HTTP Traffic Logging: Web servers are typically well-equipped to log traffic in a form useful for marketing analyses, but fall short logging traffic to web applications. In particular, most are not capable of logging the ...


4

Digicert maintains pages for compatibility with certificate types: SAN certificate compatibility Wildcard certificate compatibility They note several server side compatibility problems with wildcard certificates but no client side problems. SAN certificates are problemic for some older browsers: Versions of major web browsers from before 2003. Older ...


4

Simple answer. Hosts provide what is asked for and works best. It is a double-sided coin. Apache has been extremely successful and is stable and seasoned code therefore hosts don't have to work hard to support it. As you may know, Apache is one of the first successful web servers and serves the vast majority of web installations therefore it is asked for the ...


4

One of the biggest changes from Apache 2.2 to 2.4 is the way that permissions for directories are granted. The allow from and deny from syntax is now deprecated in favor of the new require syntax. See Upgrading Apache from 2.2 to 2.4. There is a module mod_access_compat that is supposed to allow you to still use the old syntax. Unfortunately, it didn't ...


3

Would it not be easier to inject the hostname into the rewrite rule via a RewriteCond back-reference? UseCanonicalName Off # include the IP address in the logs so they may be split LogFormat "%A %h %l %u %t \"%r\" %s %b" vcommon CustomLog /var/log/apache2/vaccess.log vcommon RewriteEngine On # a ServerName derived from a Host: header may be any case at ...


3

Apache configuration is exhaustively covered in the Apache documentation (though, if you're using Debian or Ubuntu, there are some additional considerations) and the best way to familiarize with Apache will be to study each portion of the documentation as you encounter a need to use a particular module or set of directives. To address your specific ...


3

Creating a huge .htaccess can have a serious performance impact on your system as it is read linearly for all requests, at least until a rule with the L attribute (Last Rule) is matched. The way I did something similar (about 3000 redirects) is to put a custom error page in the .htaccess. From memory the syntax is something like this: ErrorDocument 404 ...


3

You have to use mod_geoip from Maxmind. Read manual and config sample


3

No, Last-Modified is not required, as you cited from RFC 2616. I've found this issue https://github.com/mnot/redbot/issues/61 in which they implemented the check for required headers. However, they stated in the issue that only "Date" was required, but the implementation was different (by mistake, I think).


3

It seems you're not the only one having such problems, look here and here, there are some suggestions on fixes in these threads - have you ruled these out already? Are you in a multi web server environment? Could one of the servers in the pool have a corrupted copy of the image? Interestingly it's not limited to the background image, and the corruption ...


3

You CAN check for the existence of a resource identified by an HTTP URL using mod_rewrite See example below: RewriteCond %{HTTP_USER_AGENT} "android|blackberry|ipad|iphone|ipod|iemobile|opera mobile|palmos|webos|googlebot-mobile" [NC] RewriteCond %{REQUEST_URI} ![.]html$ RewriteCond %{REQUEST_URI} ^([^.]*) RewriteCond %1.html -U RewriteRule ^.*$ $0.html ...


3

Assuming you want a 301 (Moved Permanently) redirect, then put the following in the .htaccess file in your document root: Options +FollowSymLinks # Must be enabled if not already RewriteEngine On RewriteRule ^abc/content/content\.jsp\?contentId=(123|345)$ https://newpage.silkroad.com/ [R=301,L]


3

The fact that you made additional users for each of the site is great since if one gets hacked/exploited the rest is unlikely to be affected however you could go one step further. Vhosts in Home Folders You can move the hosts actually into their home folders so they are jailed so to speak which will add a little bit of extra security. You can setup the ...


3

The better solution is to code so that there is no security risk from someone requesting these files. Remember that since PHP is interpreted at the server-side then you can code your files to return an empty document or redirect elsewhere when requested. This is what Wordpress does. Try asking for any of the files you are not supposed to and what the ...


3

Mod_alias and Mod_rewrite There are 2 modules you can use within the htaccess for controlling redirects these are known as mod_alias and mod_rewrite. To help you establish the difference between the two below is some commands to familiarize when your using mod_alias or mod_rewrite. mod_alias commands Alias AliasMatch Redirect RedirectMatch ...


3

I met the same problem today. I solved it in two steps Enabling of rewrite module sudo a2enmod rewrite I changed AllowOverride None to AllowOverride All in my virtual host configuration file. AllowOverride None - prevents Apache server from reading of any .htaccess file located in your site directories. Hope it helps.



Only top voted, non community-wiki answers of a minimum length are eligible