Hot answers tagged

18

People landing in this answer, please note that this is specific for Apache 2.2. Apache 2.4 has deprecated these directives. The new way is using the module mod_authz_host and the Require directives. (link) In Apache 2.4 you should do <Directory /var/www/ncp-web/> Require host localhost Require ip 127.0.0.1 Require ip 192.168 Require ip 10 &...


15

Easy. Just set something like this within your main configuration or your virtual configuration: <Directory /var/www/path/to/your/web/documents> Order Deny,Allow Deny from all Allow from 127.0.0.1 ::1 Allow from localhost Allow from 192.168 Allow from 10 Satisfy Any </Directory> The <Directory></Directory> statement ...


9

Just as a matter of explanation for future users. Your 000-default.conf file is a catch-all site and should be left alone. It is good for security. It can be frustrating when a site configuration does not work and the default site is served. I get it. Still, leave it alone. Many people are unaware of why the default site exists. Here is a bit of an ...


6

Based on your reference to the ImageMagick convert method and quality parameter, it appears you're working with JPEG images. If that's the case, the EXIF information for JPEG images does not have a standard compression level tag. However, ImageMagick appears to be able to obtain this information from the image's quantization tables using the identify ...


6

You are probably seeing a difference in line-endings. When transferring a file in ASCII/Text mode (as opposed to "Binary mode") then most FTP clients will convert/normalise line-endings to the OS being transferred to. On Classic Mac OS (9.x and earlier) the line-ending char is simply \r (ASCII 13), on Mac OS X this changed to \n (ASCII 10), on Linux it is \...


5

Without the spike making 95th percentile 129 Mb, it looks like it would have been around 70 Mb - an 85% increase. That's significant, but the traffic alone isn't enough to determine the cause. You will need to bring the server back up (offline, if possible) and examine the log files to tell if it was a DDoS, as there could be other explanations depending on ...


5

It could be done with a single SSL certificate. Specifically, what you want to do is to provide 'Subject Alt Names' in the certificate. Take a look at Google's certificate for example, which has the following Subject Alt Names. In other words, they have one certificate for all of those domains. DNS Name: *.google.com DNS Name: *.android.com DNS ...


5

Add this section inside your virtual host directive: <Location /mypathurl> Order deny,allow Deny from all Allow from 192.168.1.10 </Location> Replace your IP above. This should not be used for financial level security, FYI.


5

You have a shared hosting plan. That means you cannot install software. Your SSH access is primarily meant for managing files remotely. You may be able to run Java or whatnot with your account, but not as a server/service. Generally, the minimum required hosting package for installing your own software is a virtual server (also called virtual machine, ...


5

Well aren't you friendly... "Hey Google, I'm having a DOS, but im making it your problem, thanks" First: There is no difference for you between serving an 301 or an 404 error page. Your server will have to do the same amount of work. The difference here is that you, with your 301->google solution, now ALSO make it Google's problem, effectively ...


4

You need to set an alias. location /coolapp/ { alias /var/www/apps/coolapp/; } Read more nginx Update after comment: Unfortunately, it's not working for me. I'm getting a 404 response when trying to request www.mysite.com/coolapp/test.php when /var/www/apps/coolapp/test.php exists To understand why alias is not working, you have to take a ...


4

I think closetnoc's advice is good, and your plan is sound, but in the comments there, you mentioned that you're running on a VPS on linode already. Depending on your time frame, what's preventing you from spinning up another VPS on linode, provisioning it exactly as needed and switching over to it, then shutting down/destroying the old VM? Is it just cost?...


3

You can use wget mirror mode, this way: $ wget -mk http://www.website.com/ you'll get a local mirror of the site in your disk. For archiving format, you can skip it, and it will allow the users to browse directly from the disk, instead of unpacking before, or you can use a war file, as some browsers support browsing from war files. If you are backuping ...


3

you can add it like this (when you have iptables ... -j LOG to mark scans you want) by adding additional fail2ban filter like this # Option: failregex # Notes: Looks for attempts on ports not open in your firewall. Expects the # iptables logging utility to be used. Add the following to your iptables # config, as the last item before you DROP or ...


3

I agree with user 'closetnoc' who replied at [2015-Aug-2 00:24:36Z] in response to the original post that wrote "The 000-default.conf site is a catch-all for any request the server does not have a configuration file for". And, I think we can make use of such 'catch-all site' as a last resort to safeguard and to enhance the overall security. The thing I ...


3

<!--?php echo "It works!"; ?--> This is what you see when you analyse the element using the browsers Object Inspector ie. the interpreted source. This is not the HTML source as sent from the server (ie. "view source"). Basically, your HTML pages are not being processed by PHP. You probably need to check with your host as to the correct directive to ...


3

You could just include a rule in your index.php to check the current time against the time you want to launch. So if you wanted to launch on 2015-12-01 at 15:00UTC, something like this should work: <?php if(time() < '1448982000'){ header("Location: https://www.example.com/",TRUE,301); exit; }?> Drop that into the very top of index.php and ...


3

If you create a page using Joomla and call it 'sitemap' it should display the content of that created page in the theme framework 'on the fly' for you. Joomla does not create a sitemap.html or sitemap.php file and put it on your server. If you created a sitemap.html file separately on your own that will not display unless you save the file to your server ...


3

Yes. Don't transfer UTF-16 files in ASCII mode; use binary mode to avoid data corruption here. FTP's transformation of \r\n to \n will corrupt the remainder of the file if it happens to contain the single character ഊ or the sequence ㄍਰ or many others of the same class. Please note that this is not an intelligent transformation, and the reverse ...


3

I figured out the issue. When an AWS instance is rebooted, the DNS address changes. As I am using Wordpress, I need to update the siteurl and home url in the MySQL Database for the wordpress site to the new DNS address. In the pictures below for example localhost should be replaced with the DNS address of the instance. When the instance reboots, this will ...


3

Under Apache, using the ProxyPassReverse directive will do what you want. It will take the redirect from the backend server and replace the backend host name with the front end name. From the documentation: This directive lets Apache httpd adjust the URL in the Location, Content-Location and URI headers on HTTP redirect responses. This is essential ...


2

An update always worth because by updating, you apply security patches and earn new features: it's always a good idea to use the last version of a web server. There is a sum up of new features of the 2.4 version compared to the 2.2 version here: http://httpd.apache.org/docs/2.4/en/upgrading.html.


2

Actually no. Except that if the site installs are from 2008, then there may be OS and other installs that may also have to be made and incompatibilities between them and the hardware. It is possible that the full suite of installs that you need to do at minimum may not work on that machine. Be prepared for that. Check for software upgrades that should also ...


2

Ironically, this is exactly the kinds of things I study in my automated security analysis research. The bot is trying to take advantage of a PHP application vulnerability to read your password file. With success, the hacker would attempt to log into various resources including the PHP application that hosted the vulnerability, as well as, other PHP ...


2

I use the exim4 email package on Ubuntu configured as a "smart host". This means you give exim4 the user name and password for your normal SMTP server and it will send the email (from commands like mail and sendmail) through that. Here is the question I asked about setting it up on AskUbuntu.com and the answer that I found: I finally found a detailed ...


2

They probably mean 70.99MB / 100GB.


2

Yes, you can implement IPv6 tunneling with 6to4, but its use in any scenario other than testing is being actively discouraged. Before implementing anything on the public Internet, we should consider whether the potentially harmful network effects of an implementation indicate a fault with the solution. I suggest reading this analysis of 6to4 latency issues ...


2

You can prevent hacking to an extent however, nothing is perfect and there are always flaws in any system. Asking a question with such little detail prevents a comprehensive insightful answer. It's advisable to read up and practice Linux and PHP security concepts. However it's impossible to make your website "hackproof", you can make it "hack-resistant" ...


2

You are right. This behavior is very similar when cPHulk Brute Force Protection blocks your IP address or the account. If only your IP address is blocked then it is easy to get access back by switching to another IP address. If that's not an option then another solution is to whitelist your IP address via SSH, /scripts/cphulkdwhitelist x.x.x.x Ref. cPHulk ...


2

The problem seems to have been resolved. I was going through the logs and noticed the server was under constant root login attack. I have installed DenyHosts and denied SSH login with passwords. The problem has not happened since then. I was shocked to see how many foreign IP addresses (from Russia, China, etc.) were trying to root login to my server!


Only top voted, non community-wiki answers of a minimum length are eligible