Hot answers tagged

18

People landing in this answer, please note that this is specific for Apache 2.2. Apache 2.4 has deprecated these directives. The new way is using the module mod_authz_host and the Require directives. (link) In Apache 2.4 you should do <Directory /var/www/ncp-web/> Require host localhost Require ip 127.0.0.1 Require ip 192.168 Require ip 10 &...


15

Easy. Just set something like this within your main configuration or your virtual configuration: <Directory /var/www/path/to/your/web/documents> Order Deny,Allow Deny from all Allow from 127.0.0.1 ::1 Allow from localhost Allow from 192.168 Allow from 10 Satisfy Any </Directory> The <Directory></Directory> statement ...


9

Just as a matter of explanation for future users. Your 000-default.conf file is a catch-all site and should be left alone. It is good for security. It can be frustrating when a site configuration does not work and the default site is served. I get it. Still, leave it alone. Many people are unaware of why the default site exists. Here is a bit of an ...


7

You are probably seeing a difference in line-endings. When transferring a file in ASCII/Text mode (as opposed to "Binary mode") then most FTP clients will convert/normalise line-endings to the OS being transferred to. On Classic Mac OS (9.x and earlier) the line-ending char is simply \r (ASCII 13), on Mac OS X this changed to \n (ASCII 10), on Linux it is \...


5

You have a shared hosting plan. That means you cannot install software. Your SSH access is primarily meant for managing files remotely. You may be able to run Java or whatnot with your account, but not as a server/service. Generally, the minimum required hosting package for installing your own software is a virtual server (also called virtual machine, ...


5

Add this section inside your virtual host directive: <Location /mypathurl> Order deny,allow Deny from all Allow from 192.168.1.10 </Location> Replace your IP above. This should not be used for financial level security, FYI.


5

Without the spike making 95th percentile 129 Mb, it looks like it would have been around 70 Mb - an 85% increase. That's significant, but the traffic alone isn't enough to determine the cause. You will need to bring the server back up (offline, if possible) and examine the log files to tell if it was a DDoS, as there could be other explanations depending on ...


5

Well aren't you friendly... "Hey Google, I'm having a DOS, but im making it your problem, thanks" First: There is no difference for you between serving an 301 or an 404 error page. Your server will have to do the same amount of work. The difference here is that you, with your 301->google solution, now ALSO make it Google's problem, effectively ...


4

You need to set an alias. location /coolapp/ { alias /var/www/apps/coolapp/; } Read more nginx Update after comment: Unfortunately, it's not working for me. I'm getting a 404 response when trying to request www.mysite.com/coolapp/test.php when /var/www/apps/coolapp/test.php exists To understand why alias is not working, you have to take a ...


4

I think closetnoc's advice is good, and your plan is sound, but in the comments there, you mentioned that you're running on a VPS on linode already. Depending on your time frame, what's preventing you from spinning up another VPS on linode, provisioning it exactly as needed and switching over to it, then shutting down/destroying the old VM? Is it just cost?...


3

I agree with user 'closetnoc' who replied at [2015-Aug-2 00:24:36Z] in response to the original post that wrote "The 000-default.conf site is a catch-all for any request the server does not have a configuration file for". And, I think we can make use of such 'catch-all site' as a last resort to safeguard and to enhance the overall security. The thing I ...


3

<!--?php echo "It works!"; ?--> This is what you see when you analyse the element using the browsers Object Inspector ie. the interpreted source. This is not the HTML source as sent from the server (ie. "view source"). Basically, your HTML pages are not being processed by PHP. You probably need to check with your host as to the correct directive to ...


3

You could just include a rule in your index.php to check the current time against the time you want to launch. So if you wanted to launch on 2015-12-01 at 15:00UTC, something like this should work: <?php if(time() < '1448982000'){ header("Location: https://www.example.com/",TRUE,301); exit; }?> Drop that into the very top of index.php and ...


3

If you create a page using Joomla and call it 'sitemap' it should display the content of that created page in the theme framework 'on the fly' for you. Joomla does not create a sitemap.html or sitemap.php file and put it on your server. If you created a sitemap.html file separately on your own that will not display unless you save the file to your server ...


3

Yes. Don't transfer UTF-16 files in ASCII mode; use binary mode to avoid data corruption here. FTP's transformation of \r\n to \n will corrupt the remainder of the file if it happens to contain the single character ഊ or the sequence ㄍਰ or many others of the same class. Please note that this is not an intelligent transformation, and the reverse ...


3

I figured out the issue. When an AWS instance is rebooted, the DNS address changes. As I am using Wordpress, I need to update the siteurl and home url in the MySQL Database for the wordpress site to the new DNS address. In the pictures below for example localhost should be replaced with the DNS address of the instance. When the instance reboots, this will ...


3

Under Apache, using the ProxyPassReverse directive will do what you want. It will take the redirect from the backend server and replace the backend host name with the front end name. From the documentation: This directive lets Apache httpd adjust the URL in the Location, Content-Location and URI headers on HTTP redirect responses. This is essential ...


3

There is absolutely no need for a mail server to be on the same machine, in the same building, or even located in the same country as the web server. In your DNS records you will see MX records, which will indicate the hostname of your mail server. Typically, most people would set this as a sub of their own domain (i.e. mail.example.com) and create an A ...


3

As the multiple previous people mentioned, you need to check your data. A huge amount of that traffic could be from one IP, it's trivially easy to write a bot that rotates fictional IP addresses. Even if it's not obviously bot traffic, did they spend any time on your website? The only way to get an idea of what is causing it is to really dig into your log ...


3

This appears to be related to a cluster of exploits that target fiber optic routers. If you are running a simple HTTP website and you are not maintaining fiber optic router equipment, I believe you can ignore those requests.


2

Here is a small script that I use. I have an SSL based site, so I'm checking the active connections on port 443. You might want to update 443 to 80, depending on what you would like to monitor. #!/bin/bash [ $# -eq 0 ] && { echo "Usage: $0 <refresh time>" ; exit 1; } while true do clear; echo "Number of Active Connections:"; ...


2

I would like to share the steps I followed recently in regards to this question. If you want to transfer the email accounts and messages for a domain from one server to another, you can easily do this by completing two simple steps. Let's call the domain mydomain.com for example. Make sure that you have an account with the mydomain.com domain or the domain ...


2

An update always worth because by updating, you apply security patches and earn new features: it's always a good idea to use the last version of a web server. There is a sum up of new features of the 2.4 version compared to the 2.2 version here: http://httpd.apache.org/docs/2.4/en/upgrading.html.


2

Actually no. Except that if the site installs are from 2008, then there may be OS and other installs that may also have to be made and incompatibilities between them and the hardware. It is possible that the full suite of installs that you need to do at minimum may not work on that machine. Be prepared for that. Check for software upgrades that should also ...


2

Ironically, this is exactly the kinds of things I study in my automated security analysis research. The bot is trying to take advantage of a PHP application vulnerability to read your password file. With success, the hacker would attempt to log into various resources including the PHP application that hosted the vulnerability, as well as, other PHP ...


2

I use the exim4 email package on Ubuntu configured as a "smart host". This means you give exim4 the user name and password for your normal SMTP server and it will send the email (from commands like mail and sendmail) through that. Here is the question I asked about setting it up on AskUbuntu.com and the answer that I found: I finally found a detailed ...


2

You can prevent hacking to an extent however, nothing is perfect and there are always flaws in any system. Asking a question with such little detail prevents a comprehensive insightful answer. It's advisable to read up and practice Linux and PHP security concepts. However it's impossible to make your website "hackproof", you can make it "hack-resistant" ...


2

They probably mean 70.99MB / 100GB.


2

Yes, you can implement IPv6 tunneling with 6to4, but its use in any scenario other than testing is being actively discouraged. Before implementing anything on the public Internet, we should consider whether the potentially harmful network effects of an implementation indicate a fault with the solution. I suggest reading this analysis of 6to4 latency issues ...


2

The problem seems to have been resolved. I was going through the logs and noticed the server was under constant root login attack. I have installed DenyHosts and denied SSH login with passwords. The problem has not happened since then. I was shocked to see how many foreign IP addresses (from Russia, China, etc.) were trying to root login to my server!


Only top voted, non community-wiki answers of a minimum length are eligible